It's unexpected to anyone with intuition about how a computer traditionally is supposed to work. As a general principle, as a user, I expect a file on one computer to be usable on another computer. Or, at the very least, if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. The idea of a file that is only usable on a particular computer feels weird.
> You can export your passwords to a plain text CSV from the original computer.
Exporting a private key from a keychain is hard to automate (the password of the keychain is asked for all exports, and HAS to be typed manually IIRC).
But that’s not backup restore? I’m thinking Time Machine restore on a new Mac when old one is no longer working. Or when the old one had to be wiped and restored.
It's also unexpected when you send your laptop in for a screen replacement, the tech does an unnecessary logic board swap while he's at it, and your local keychain doesn't work anymore. And then Apple Support will say, hey, we told you you needed to backup your data! Which you did, but that's not the issue.
I've learned to not trust Apple support on anything. My daughter's Watch screen cracked and we sent it in for a replacement. To setup the replacement though, they requried that she unpair then repair the watch then-and-there. They said she wouldn't lose any data, that it just disconnected it from the phone.
Nope, unpairing is a complete reset apparently. And Apple Support was apparently not trained to know that not everything syncs in the backup. She lost all her voice memos, which she uses for class notes, and probably other app data as well.
It's unexpected to anyone with intuition about how a computer traditionally is supposed to work. As a general principle, as a user, I expect a file on one computer to be usable on another computer. Or, at the very least, if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it. The idea of a file that is only usable on a particular computer feels weird.
> As a general principle, as a user, I expect a file on one computer to be usable on another computer.
As a general rule, I expect a file on an encrypted disk to be unreadable for anyone who lacks the encryption key(s).
> if I need to obtain some other thing from the original computer to "unlock" that file, I should be able to do it.
You can export your passwords to a plain text CSV from the original computer.
As a general rule, I expect a file on an encrypted disk to be encrypted with a key derived from a password I provide.
7 replies →
As a general rule, if I'm the user of both disks I expect to have the encryption key(s).
> You can export your passwords to a plain text CSV from the original computer.
Exporting a private key from a keychain is hard to automate (the password of the keychain is asked for all exports, and HAS to be typed manually IIRC).
The right way to do that is FDE, where you can't even mount the filesystem to see the files without having the decryption key.
I've done Tahoe-to-Tahoe migration assistant moves between machines in recent months. No issues with login keychain migration.
But that’s not backup restore? I’m thinking Time Machine restore on a new Mac when old one is no longer working. Or when the old one had to be wiped and restored.
Migration Assistant uses the old Mac, which can unlock its login keychain and allow the keychain items to be copied.
What if the old Mac is dead, stolen, lost? Those are the scenarios in which one recovers on a new machine from a backup.
3 replies →
Migration assistant can also use a TM backup, I’m pretty sure
It's also unexpected when you send your laptop in for a screen replacement, the tech does an unnecessary logic board swap while he's at it, and your local keychain doesn't work anymore. And then Apple Support will say, hey, we told you you needed to backup your data! Which you did, but that's not the issue.
Use iCloud Keychain or don't use Keychain at all.
I've learned to not trust Apple support on anything. My daughter's Watch screen cracked and we sent it in for a replacement. To setup the replacement though, they requried that she unpair then repair the watch then-and-there. They said she wouldn't lose any data, that it just disconnected it from the phone.
Nope, unpairing is a complete reset apparently. And Apple Support was apparently not trained to know that not everything syncs in the backup. She lost all her voice memos, which she uses for class notes, and probably other app data as well.
Or create a separate keychain db and use that. The encryption is only done for the login keychain.
Don't backup keys, rotate them.
I can't rotate my keys if I lose access to accounts because my computer died and my backup is useless.
Yeah, that's why secure enclaves embedded in complex devices are a bad idea.
Hardware keys are the way:
- Less likely to fail in the first place
- Cheap enough to have several of so you can use one to log in and manage the others in the event of loss
- Easy to move between devices
- Less likely to use the auth handshake as a side channel for things you didn't consent to
3 replies →