Copying login keychains between Macs fails on Secure Enclave Macs with Tahoe

4 comments

• flyingshelf 2 minutes ago
  And yet if you click export it will gladly print out a plaintext csv with your whole life in passwords. Doesn't even attempt to zip it with password or something.
• dfabulich 13 minutes ago
  Does the macoOS login keychain get backed up by Time Machine backups in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?
• shenenee 1 hour ago
  This is pretty much how it's suppose to work...
  [-]
  • winstonwinston 45 minutes ago
    Maybe but this is unexpected if you need to restore from a backup..
    [-]
    • petronic 22 minutes ago
      I've done Tahoe-to-Tahoe migration assistant moves between machines in recent months. No issues with login keychain migration.
      [-]
      • winstonwinston 9 minutes ago
        But that’s not backup restore? I’m thinking Time Machine restore on a new Mac when old one is no longer working. Or when the old one had to be wiped and restored.
    • __MatrixMan__ 23 minutes ago
      Don't backup keys, rotate them.
      [-]
      • gavinsyancey 5 minutes ago
        I can't rotate my keys if I lose access to accounts because my computer died and my backup is useless.
  • Retr0id 47 minutes ago
    I'm more interested by the fact that it apparently didn't work this way before Tahoe.
    [-]
    • pram 41 minutes ago
      IIRC there are options for exportable and un-exportable private keys when you make one in the secure enclave. Going to guess Tahoe made them un-exportable by default.
• cute_boi 19 minutes ago
  This is good.