secretive README

The project's README from github.com/maxgoedjen/secretive. As one markdown file: README.md.

Secretive Test Release

Secretive is an app for protecting and managing SSH keys with the Secure Enclave. Screenshot of Secretive

Why?

Safer Storage

The most common setup for SSH keys is just keeping them on disk, guarded by proper permissions. This is fine in most cases, but it's not super hard for malicious users or malware to copy your private key. If you protect your keys with the Secure Enclave, it's impossible to export them, by design.

Access Control

If your Mac has a Secure Enclave, it also has support for strong access controls like Touch ID, or authentication with Apple Watch. You can configure your keys so that they require Touch ID (or Watch) authentication before they're accessed.

Screenshot of Secretive authenticating with Touch ID

Notifications

Secretive also notifies you whenever your keys are accessed, so you're never caught off guard.

Screenshot of Secretive notifying the user

Support for Smart Cards Too!

For Macs without Secure Enclaves, you can configure a Smart Card (such as a YubiKey) and use it for signing as well.

Getting Started

Installation

Direct Download

You can download the latest release over on the Releases Page

Using Homebrew

brew install secretive

FAQ

There's a FAQ here.

Auditable Build Process

Builds are produced by GitHub Actions with an auditable build and release generation process. Starting with Secretive 3.0, builds are attested using GitHub Artifact Attestation. Attestations are viewable in the build log for a build, and also on the main attestation page.

A Note Around Code Signing and Keychains

While Secretive uses the Secure Enclave to protect keys, it still relies on Keychain APIs to store and access them. Keychain restricts reads of keys to the app (and specifically, the bundle ID) that created them. If you build Secretive from source, make sure you are consistent in which bundle ID you use so that the Keychain is able to locate your keys.

Backups and Transfers to New Machines

Because secrets in the Secure Enclave are not exportable, they are not able to be backed up, and you will not be able to transfer them to a new machine. If you get a new Mac, just create a new set of secrets specific to that Mac.

Security

Secretive's security policy is detailed in SECURITY.md. To report security issues, please use GitHub's private reporting feature.

Acknowledgements

sekey

Secretive was inspired by the sekey project.

Localization

Secretive is localized to many languages by a generous team of volunteers. To learn more, see LOCALIZING.md. Secretive's localization workflow is generously provided by Crowdin.

secretive (maxgoedjen/secretive)

ssh
Searching Database…

9.1K ·GitHub
Secretive
What is this?Secretive is a macOS app that stores and manages SSH keys inside your Mac's Secure Enclave instead of on disk, so the private key material can never be exported or copied.
Is it a background service or an app I open?It's a native macOS app with a UI for managing keys, plus an SSH agent it runs in the background to serve signing requests.
Do I need a Mac with a Secure Enclave for this to work?You need a Mac with a Secure Enclave to get hardware-backed key storage; if your Mac lacks one, you can instead use a Smart Card like a YubiKey.
Can I back up or move my keys to a new Mac?No. Because keys live in the Secure Enclave, they're not exportable, so they can't be backed up or transferred; on a new Mac you just generate a fresh set of keys.
Does this only work on macOS?Yes, it's a macOS-only app built with Swift that relies on Apple's Secure Enclave and Keychain APIs.
Does Secretive track or access my keys without me knowing?No, it does the opposite: it notifies you every time a key is accessed so you're never caught off guard.
Can I require Touch ID before a key is used?Yes, keys can be configured to require Touch ID or Apple Watch authentication before they're accessed.
Why not just use a key file on disk?Disk-stored keys are protected only by file permissions, making them relatively easy for malware or attackers to copy; Secure Enclave storage makes the key physically impossible to export.
Are the release builds trustworthy?Builds are produced via GitHub Actions with an auditable process, and since version 3.0 are attested using GitHub Artifact Attestation, which you can verify on the attestation page.
Why does building from source matter for Keychain access?Keychain restricts key access to the app bundle ID that created the key, so if you build from source you must keep the same bundle ID consistently or Secretive won't be able to find your existing keys.
What are similar projects?PureMac, greenbubbles, OpenYoink, RemoveMacAI, Insomnia, leftopen, AirCard, vphone-cli
Which topics is it in?mac, localization, notifications, ssh, homebrew, macos-app, apple, sysadmin, apple-silicon, cli-tool, encryption, swift
Creator
maxgoedjen
Size
20.6 MB
Stars
9.1K
Updated
CommitOct 18Releasev4.0.0Sep 21
Age
6y
Commits · 90 Days