alt Hacker NewsThose access token can still be stolen just the same. The Secure Enclave is better because you can ask it to authorise the action, but you can never get the key out of it, so the latest malicious npm package can’t send off your access tokens or ssh keys.
absolute security does not exist, but each small improvement adds up. I quite like having to authorize each remote git action with Touch ID.