Copying login keychains between Macs fails on Secure Enclave Macs with Tahoe

(derflounder.wordpress.com)

26 points | by zdw 18 hours ago

4 comments

  • dfabulich 14 minutes ago
    Does the macoOS login keychain get backed up by Time Machine backups in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
  • shenenee 1 hour ago
    This is pretty much how it's suppose to work...
    • winstonwinston 45 minutes ago
      Maybe but this is unexpected if you need to restore from a backup..
      • petronic 23 minutes ago
        I've done Tahoe-to-Tahoe migration assistant moves between machines in recent months. No issues with login keychain migration.
        • winstonwinston 10 minutes ago
          But that’s not backup restore? I’m thinking Time Machine restore on a new Mac when old one is no longer working. Or when the old one had to be wiped and restored.
      • __MatrixMan__ 24 minutes ago
        Don't backup keys, rotate them.
        • gavinsyancey 6 minutes ago
          I can't rotate my keys if I lose access to accounts because my computer died and my backup is useless.
    • Retr0id 47 minutes ago
      I'm more interested by the fact that it apparently didn't work this way before Tahoe.
      • pram 42 minutes ago
        IIRC there are options for exportable and un-exportable private keys when you make one in the secure enclave. Going to guess Tahoe made them un-exportable by default.
  • flyingshelf 2 minutes ago
    And yet if you click export it will gladly print out a plaintext csv with your whole life in passwords. Doesn't even attempt to zip it with password or something.
    • ImPostingOnHN 0 minutes ago
      that seems reasonable, as it is the lowest common denominator for interoperability

      what would be dumb is if it was in some format that couldn't be used by other systems without extra work, and if the user weren't allowed to use their own computer to do something different

  • cute_boi 19 minutes ago
    This is good.