First screen, captured 2 days ago. Open the video.

Protecting SSH Keys with macOS Secure Enclave

What HN thinks

Everyone agrees keys belong in hardware, right up until the hardware eats their WireGuard configs.

Secretive makes the enclave usable
Many commenters, including the author, use Secretive for Secure Enclave SSH keys with Touch ID, often forwarding the agent into VMs or containers, or using it for remote sudo.
Platform keystores are fragile
Keychain bugs, undocumented APIs and non-exportable keys mean you can lose access, so keep backup keys and expect breakage, as the WireGuard config-deletion story shows.
Portable hardware keys or passphrases instead
Some prefer vendor-independent YubiKeys or TKeys, or argue a passphrase-protected key plus agent is enough. Others say presence-gated signing is what actually stops malware and AI agents.

Consensus: Requiring physical presence to use a non-extractable key is broadly seen as worthwhile, especially for keeping AI agents and malware away from servers. The tooling is still widely considered clunky and poorly documented.

Recommended in the comments

Secretive ↗ (tool): Easy setup, per-key Touch ID or notify settings, and works with agent forwarding.
YubiKey ↗ (product): Vendor-independent and portable, so you can keep backup keys in other places.
1Password ↗ (service): Lets you share keys across machines and use service accounts to cut down prompt fatigue.
TKey ↗ (product): Fully open hardware that handles ed25519 SSH keys well.
pam_rssh ↗ (library): Enables remote sudo approved with Touch ID through a forwarded agent.
ts-ssh-agent ↗ (tool): Its author says it removes agent forwarding pain for remote coding agents.

Summarised by Claude from the comment thread 2 days ago.

Points: 363
Comments: 131
Best rank: #1
Posted: 2026-11-11 by js2
Category: Security

ssh macos secure-enclave touch-id cryptotokenkit secretive

All captures:

Full page

Captured 2 days ago. Click for the whole screenshot.

Looks similar

Screenshot of gyptazy.com: Live-migration support in FreeBSD and bhyve coming

Live-migration support in FreeBSD and bhyve coming (gyptazy.com)

63 points by JohnDohnBohn 5 hours ago | 15 comments

Blog post presenting a work-in-progress RFC implementation of live VM migration for bhyve on FreeBSD 15.1, covering design, test results, and blockers to upstreaming.

freebsd bhyve live-migration virtualization

Screenshot of stork.ai: Apple capped engineers at a $200 daily AI budget

Apple capped engineers at a $200 daily AI budget (stork.ai)

60 points by GloVin 4 days ago | 76 comments

A Stork AI daily newsletter issue led by a report that Apple cut some engineers' daily AI spending cap to $200, plus other AI news items.

apple ai-costs llm-inference tokenization

Screenshot of bsdhowto.ch: Why not use DNS over HTTPS (DoH)?

Why not use DNS over HTTPS (DoH)?(bsdhowto.ch)

137 points by Bogdanp 1 year ago | 230 comments

Screenshot of safedep.io: Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor

Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor (safedep.io)

582 points by abhisek 23 days ago | 192 comments

SafeDep analysis of the compromised LiteLLM 1.107.0 PyPI release, which installed a credential stealer and remote-code backdoor via .pth and sitecustomize files, with IOCs.

supply-chain-attack litellm pypi python

Screenshot of wadetregaskis.com: macOS 27 does not support CoreStorage volumes

macOS 27 does not support CoreStorage volumes (wadetregaskis.com)

113 points by colejohnson66 10 days ago | 94 comments

Blog post describing how macOS 27 Golden Gate fails to mount, convert, or erase CoreStorage encrypted HFS+ volumes, with debugging details and a workaround.

macos corestorage hfs-plus apfs

Screenshot of karthihegde.dev: So my ISP was hijacking my DNS

So my ISP was hijacking my DNS (karthihegde.dev)

202 points by frostbyte7 9 days ago | 157 comments

A blog post describing how the author discovered their Indian ISP was hijacking plaintext DNS queries, and explaining DoH, DoT, DNSSEC, Unbound and their own encrypted DNS setup.

dns dns-hijacking dns-over-https dnssec