Feature Request: Per key unlock time

maxgoedjen / secretive

Store SSH keys in the Secure Enclave

MIT License

7.16k stars 158 forks source link

Feature Request: Per key unlock time #355

Open zachberger opened 2 years ago

zachberger commented 2 years ago

There are some keys I always want to have unlocked for ~5 minutes while I run automation. Building off of the new feature where I can unlock a key for X minutes via the notification, it would be great to be able to set individual keys with a predefined unlock period.

maxgoedjen commented 2 years ago

Probably technically possible, if it's at key creation (maybe even after? Tricky part there is I can't tell if a key will require auth unless I marked it somewhere during creation)

Messaging might be confusing too.

Overall I can see the appeal, just need to think if there's a way I can set it up nicely.

zachberger commented 2 years ago

Thanks - I actually keep two keys right now because of the current mechanism:

For use cases where I'm actively involved (e.g. github, gitlab, ssh-ing to certain servers), I use a key with auth required.
For use cases where automation takes a series of steps requiring ssh such as docker-compose, or other scripts I've written I have auth disabled because I don't want to press my finger 10-50x depending on the use case.

Ideally for the second case the fingerprint would be required for the first use, but subsequent uses wouldn't require it for some time. Perhaps there is some other option than a timeout?

ben-z commented 2 years ago

I second this request. My use case is pulling a git repo with lots of submodules. If I use a key that requires Touch ID, I have to do the Touch ID auth for every submodule.

maxgoedjen commented 2 years ago

Probably technically possible, if it's at key creation (maybe even after? Tricky part there is I can't tell if a key will require auth unless I marked it somewhere during creation)

So an update on this, I did manage to figure out how to determine this here: https://github.com/maxgoedjen/secretive/pull/357

I've got this tracked separately: https://github.com/maxgoedjen/secretive/issues/358 – there's some complications around communication between the agent and the host app, but I'm doing some thinking about how to deal with that.