Secure Enclave: How FoxTerm Protects Your Most Sensitive Credentials
Your SSH private keys deserve better than file-based storage. FoxTerm leverages Apple's Secure Enclave to keep your credentials safe from malware, memory dumps, and unauthorized access.
In cybersecurity, we talk a lot about encryption, firewalls, and access controls. But the most critical asset in any developer's toolkit is often overlooked: the SSH private key.
This single file grants access to every server you manage. If it's compromised, your entire infrastructure is at risk. Yet most SSH clients store it as a plain file on disk, protected only by file system permissions.
FoxTerm takes a fundamentally different approach.
What Is the Secure Enclave?
The Secure Enclave is a hardware security module built into every Apple Silicon Mac and iPhone. It's a separate processor with its own:
- Secure boot chain — Independent from the main OS
- Encrypted memory — Not accessible to macOS or apps
- Cryptographic engine — Performs operations without exposing keys
- Biometric interface — Requires Face ID or Touch ID for access
Think of it as a vault inside your device. Even if someone gains root access to your Mac, they cannot read what's inside the Secure Enclave.
How FoxTerm Uses It
When you generate or import an SSH key in FoxTerm, you have the option to store it in the Secure Enclave. Here's what happens:
Key Generation
The private key is generated inside the Secure Enclave. It never exists in RAM, on disk, or in any form that FoxTerm (or any other process) can read.
Key Usage
When you authenticate to a server, FoxTerm sends a signing request to the Secure Enclave. The enclave signs the challenge and returns the signature — but never reveals the private key itself.
Biometric Gating
Access to Secure Enclave-stored keys requires biometric verification. Even if someone steals your unlocked MacBook, they cannot use your SSH keys without your face or fingerprint.
The Threat Model
Consider what happens with traditional file-based keys:
| Threat | File-Based Key | Secure Enclave Key |
|---|---|---|
| Malware reads files | ❌ Compromised | ✅ Safe |
| Memory dump attack | ❌ Key exposed | ✅ Key never in RAM |
| Backup sync leak | ❌ Copied to cloud | ✅ Device-only storage |
| Physical theft | ❌ Accessible if unlocked | ✅ Requires biometrics |
| Root access exploit | ❌ Files readable | ✅ Hardware-isolated |
Zero Telemetry
Security isn't just about encryption — it's about trust. FoxTerm collects zero telemetry:
- No analytics SDKs
- No crash reporting without explicit consent
- No usage tracking
- No "phone home" behavior
You can verify this by auditing the codebase. There are no hidden network calls, no third-party tracking libraries, and no data collection of any kind.
App Sandbox
FoxTerm runs in macOS App Sandbox, which limits file system access to only what's explicitly needed. Even if a vulnerability were discovered, the sandbox contains the damage.
Best Practices
To maximize security:
- Store keys in Secure Enclave — Use biometric-gated keys for sensitive servers
- Use strong passphrases — Add an extra layer for non-Secure Enclave keys
- Rotate keys regularly — Limit the blast radius of potential compromise
- Audit authorized_keys — Remove unused keys from servers
The Bottom Line
Your SSH keys are the master keys to your infrastructure. They deserve hardware-level protection, not just file system permissions. FoxTerm provides that protection out of the box.
Download FoxTerm at foxterm.app.