Copying login keychains between Macs fails on Secure Enclave Macs with Tahoe

zzdw about 20 hours ago 33 commentsRead Article on derflounder.wordpress.com

DE version is available. Content is displayed in original English for accuracy.

⚡ Community Insights

Discussion Sentiment

75% Positive

Analyzed from 575 words in the discussion.

Discussion (33 Comments)Read Original on HackerNews

ok_dad•25 minutes ago

It sounds like they are using envelope encryption and using the Secure Enclave to derive the row keys each time. Not really any easy way around that except they should provide a tool to export it, TBH. I am guessing they weren’t using envelope encryption before or they were deriving the row keys from the password. This is a secure design but more security usually means less usability these days.

xmddmx•about 1 hour ago

Disturbing if true, as it suggests my "everything" backups aren't really full backups at all.

I wonder, if you have enabled iCloud keychain, does that provide another way to get your passwords back?

Suppose my MacBook is stolen, but I still have my iPhone. Could I use the passwords app on the iPhone to retrieve my passwords. Would that include all of them or only a subset?

lapcat•41 minutes ago

The iCloud keychain is separate from the login keychain. The Passwords app doesn't use the login keychain.

shenenee•about 3 hours ago

This is pretty much how it's suppose to work...

winstonwinston•about 3 hours ago

Maybe but this is unexpected if you need to restore from a backup..

ryandrake•about 2 hours ago

It's unexpected to anyone with intuition about how a computer traditionally is supposed to work. As a general principle, as a user, I expect a file on one computer to be usable on another computer. Or, at the very least, if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. The idea of a file that is only usable on a particular computer feels weird.

GeekyBear•about 1 hour ago

> As a general principle, as a user, I expect a file on one computer to be usable on another computer.

As a general rule, I expect a file on an encrypted disk to be unreadable for anyone who lacks the encryption key(s).

> if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it.

You can export your passwords to a plain text CSV from the original computer.

petronic•about 2 hours ago

I've done Tahoe-to-Tahoe migration assistant moves between machines in recent months. No issues with login keychain migration.

winstonwinston•about 2 hours ago

But that’s not backup restore? I’m thinking Time Machine restore on a new Mac when old one is no longer working. Or when the old one had to be wiped and restored.

lapcat•about 2 hours ago

Migration Assistant uses the old Mac, which can unlock its login keychain and allow the keychain items to be copied.

__MatrixMan__•about 2 hours ago

Don't backup keys, rotate them.

gavinsyancey•about 2 hours ago

I can't rotate my keys if I lose access to accounts because my computer died and my backup is useless.

Retr0id•about 3 hours ago

I'm more interested by the fact that it apparently didn't work this way before Tahoe.

pram•about 3 hours ago

IIRC there are options for exportable and un-exportable private keys when you make one in the secure enclave. Going to guess Tahoe made them un-exportable by default.

what•about 2 hours ago

As far as I know, you have never been able to import or export keys from the Secure Enclave. It’s more likely that previously keys were stored in the keychain and now they are generated in the SE by default.

lapcat•about 2 hours ago

> This is pretty much how it's suppose to work...

No, it's not, and that's not how it ever worked in macOS 26.3 and earlier.

This change was introduced in 26.4 for some reason.

dfabulich•about 2 hours ago

Does the macoOS login keychain get backed up by Time Machine backups in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?

lapcat•about 2 hours ago

Does the macoOS login keychain get backed up by Time Machine backups

Yes

> in a way that could restore the keychain if the original machine's Secure Enclave is lost or destroyed?

Apparently not

dfabulich•about 1 hour ago

"Apparently"? Is this something that can be tested with VMs?

lapcat•40 minutes ago

I've tested with VMs. However, I'm unclear about the relationship if any between VMs and the secure enclave.

tencentshill•about 1 hour ago

It's always a good idea to plan to hang on to your old machine for a few weeks to ensure everything works properly on the new one. Apple makes that much easier to forget.

lapcat•39 minutes ago

This was introduced, unannounced, in macOS 26.4! See my blog post for more information: https://lapcatsoftware.com/articles/2026/9/4.html

flyingshelf•about 2 hours ago

And yet if you click export it will gladly print out a plaintext csv with your whole life in passwords. Doesn't even attempt to zip it with password or something.

ImPostingOnHN•about 2 hours ago

that seems reasonable, as it is the lowest common denominator for interoperability

what would be unfortunate is if it was in some format that couldn't be used by most other systems without extra work, and if the user wasn't able to use their own property to export their own passwords in a different format.

cute_boi•about 2 hours ago

This is good.