Can you clone or sync hardware keys? Maybe they don't fail as much as computers do but they can be lost or stolen like the keys that we use to open (dumb) doors.
My non hardware key is a keypass file that I update only on my laptop and I sync to my other devices. I have plenty of backups. It does also the TOTP required to login into some customers servers.
I have a few yubikeys and it’s a manual process to sync a new key last time I tried
I keep all my TOTP keys on an encrypted usb drive in a safe. When I lose a key, I manually add all the TOTP accounts onto the new key from my safe
Passkeys are a different story. Every account I need to make sure I have multiple yubikeys registered. When I lose one, I get in via a second key and then add the replacement one.
It’s a pain but it’s a model that makes sense to me. Lose the key? Time to reach for my backup key.
Yeah it feels pretty dumb to have to register all of my keys with each service, but as far as I can tell it's the least dumb thing.
It would be nice if you could store signatures on them. Keep the master key in a safe somewhere, use it to sign the ones you carry around, register them with services, and since they all bear the same signature of the master key, services see them as interchangeable. So far as I know, they're not so mutable as that.
But that’s not backup restore? I’m thinking Time Machine restore on a new Mac when old one is no longer working. Or when the old one had to be wiped and restored.
It's unexpected to anyone with intuition about how a computer traditionally is supposed to work. As a general principle, as a user, I expect a file on one computer to be usable on another computer. Or, at the very least, if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. The idea of a file that is only usable on a particular computer feels weird.
> You can export your passwords to a plain text CSV from the original computer.
Exporting a private key from a keychain is hard to automate (the password of the keychain is asked for all exports, and HAS to be typed manually IIRC).
It's also unexpected when you send your laptop in for a screen replacement, the tech does an unnecessary logic board swap while he's at it, and your local keychain doesn't work anymore. And then Apple Support will say, hey, we told you you needed to backup your data! Which you did, but that's not the issue.
I've learned to not trust Apple support on anything. My daughter's Watch screen cracked and we sent it in for a replacement. To setup the replacement though, they requried that she unpair then repair the watch then-and-there. They said she wouldn't lose any data, that it just disconnected it from the phone.
Nope, unpairing is a complete reset apparently. And Apple Support was apparently not trained to know that not everything syncs in the backup. She lost all her voice memos, which she uses for class notes, and probably other app data as well.
Does the macoOS login keychain get backed up by Time Machine backups in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
And yet if you click export it will gladly print out a plaintext csv with your whole life in passwords. Doesn't even attempt to zip it with password or something.
Disturbing if true, as it suggests my "everything" backups aren't really full backups at all.
I wonder, if you have enabled iCloud keychain, does that provide another way to get your passwords back?
Suppose my MacBook is stolen, but I still have my iPhone. Could I use the passwords app on the iPhone to retrieve my passwords. Would that include all of them or only a subset?
I have no idea which keychain is in which, but the last time I migrated from one Apple laptop to another, I couldn't get the automated tool to work at all, so I restored a physical backup, went through the sign-in process, and passwords and passkeys migrated correctly.
Passwords and passkeys are in the iCloud keychain. You can technically save passwords in the login keychain (not sure about passkeys), but if you’re using the Passwords app it will be in the iCloud one.
This is so critical. Not just verifying the hashes, not just restoring, but actually booting into it and opening the top 5-10 things you're going to care about.
If it's your personal stuff, skip it at your own peril. If it's a paid responsibility, that's what hourly billing is for (this incentive was much stronger when I learned netadmin, back before nvmes)
I tested restoring my restic backups to the same PC and it worked. If I was forced to use a mac and Apple's password manager, I'd probably do the same test, conclude it worked, and then later lose all my data. If you care about keeping your data, there's no substitute for understand how things work.
It's unreasonable to ask everyone to own a second computer just to test restoring backups on, and it sounds like doing the test on the same computer wouldn't have caught this problem.
It's always a good idea to plan to hang on to your old machine for a few weeks to ensure everything works properly on the new one. Apple makes that much easier to forget.
It sounds like they are using envelope encryption and using the Secure Enclave to derive the row keys each time. Not really any easy way around that except they should provide a tool to export it, TBH. I am guessing they weren’t using envelope encryption before or they were deriving the row keys from the password. This is a secure design but more security usually means less usability these days.
Switching from macOS to Linux was quite painful because the security was so seamless on Mac. But I also realized I had no idea how my passwords are stored and under what guarantees. Learning and getting the hardware tokens to do it properly on Linux was a PITA. But reading this post made me feel a pinch better.
Recently tried to initialize one Mac from another - kids, never ever attempt that! Microsoft stuff doesn't get copied over properly, and refuses to behave even if you delete an account and create a new one - the only solution is re-installing the OS from scratch. And if you want to do so, and you erase the disk - surprise surprise, in recovery mode macOS doesn't work with the WPA2/WPA3 Enterprise network; you need to go and find a WPA2 network somewhere to re-install the OS. Does the recovery menu explain that somewhere? Hell no. Damn, installing a linux distro from a usb stick is a better experience than re-installing macOS these days!
52 comments
[ 0.21 ms ] story [ 82.7 ms ] threadHardware keys are the way:
- Less likely to fail in the first place
- Cheap enough to have several of so you can use one to log in and manage the others in the event of loss
- Easy to move between devices
- Less likely to use the auth handshake as a side channel for things you didn't consent to
My non hardware key is a keypass file that I update only on my laptop and I sync to my other devices. I have plenty of backups. It does also the TOTP required to login into some customers servers.
I keep all my TOTP keys on an encrypted usb drive in a safe. When I lose a key, I manually add all the TOTP accounts onto the new key from my safe
Passkeys are a different story. Every account I need to make sure I have multiple yubikeys registered. When I lose one, I get in via a second key and then add the replacement one.
It’s a pain but it’s a model that makes sense to me. Lose the key? Time to reach for my backup key.
It would be nice if you could store signatures on them. Keep the master key in a safe somewhere, use it to sign the ones you carry around, register them with services, and since they all bear the same signature of the master key, services see them as interchangeable. So far as I know, they're not so mutable as that.
Do some research and try to come up with a plausible answer to that
Pretty much everything?
As a general rule, I expect a file on an encrypted disk to be unreadable for anyone who lacks the encryption key(s).
Exporting a private key from a keychain is hard to automate (the password of the keychain is asked for all exports, and HAS to be typed manually IIRC).
Use iCloud Keychain or don't use Keychain at all.
Nope, unpairing is a complete reset apparently. And Apple Support was apparently not trained to know that not everything syncs in the backup. She lost all her voice memos, which she uses for class notes, and probably other app data as well.
No, it's not, and that's not how it ever worked in macOS 26.3 and earlier.
This change was introduced in 26.4 for some reason.
No, it's not, and that's not how it ever worked in macOS 26.3 and earlier.
This change was introduced in 26.4 for some reason.
Yes
> in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
Apparently not
I wonder, if you have enabled iCloud keychain, does that provide another way to get your passwords back?
Suppose my MacBook is stolen, but I still have my iPhone. Could I use the passwords app on the iPhone to retrieve my passwords. Would that include all of them or only a subset?
If it's your personal stuff, skip it at your own peril. If it's a paid responsibility, that's what hourly billing is for (this incentive was much stronger when I learned netadmin, back before nvmes)
Doing it on a second computer wouldn't have caught this problem either with macOS 26.3 and earlier, because it was introduced in 26.4.
Randomly, Chromium-based browser profiles can't perfectly copy across macOS machines either, because of some HMAC hashing that happens to extensions.