Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Kryptonite – a new home for your SSH private key

krypt.co

Post reply on HN
Print view View original

171–180 of 227 posts

Re: Show HN: Kryptonite – a new home for your SSH private key

#171

Post by tptacek »

jancsika wrote: post #159
tptacek wrote: post #46

Earlier quoted context omitted.

* Every application on the phone is sandboxed. * The disk is encrypted by default, and the OS is aggressive about keeping it encrypted ; a booted-up computer is almost always decrypted. * The language runtimes on the phone are hardened. * The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. * The phone's us…

So if I buy such a phone, what is the relationship between the baseband chip/OS and all the bullet points you listed above? https://www.fsf.org/blogs/community/replicant-developers-fin... It's a real pain, but I can buy a laptop/desktop that doesn't have Intel ME (or its AMD equivalent) running on it. But there's no such thing as a working phone without a baseband OS. And AFAICT there isn't a single available baseban…

Use a Google or Apple phone and stop worrying about their basebands, which are effectively USB peripherals.

Re: Show HN: Kryptonite – a new home for your SSH private key

#172

Post by tptacek »

peterwwillis wrote: post #144
tptacek wrote: post #46

Earlier quoted context omitted.

* Every application on the phone is sandboxed. * The disk is encrypted by default, and the OS is aggressive about keeping it encrypted ; a booted-up computer is almost always decrypted. * The language runtimes on the phone are hardened. * The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. * The phone's us…

Was that satire? Security Problems: Android-specific -- Android 5 was supposed to make encryption mandatory, but it killed performance, so they rolled that back. Android 6 was supposed to do it again, but if your phone isn't fast enough, or you are upgrading, again it isn't mandatory. My Android 6 phone didn't use encryption until I enabled a pin and biometrics. -- Many of the old versions of Android that will never…

I didn't bother reading the Android list. If you're concerned about Android security, as I am, don't use Android phones.

Your iPhone list has virtually nothing to do with the difference in security between phones and computers. It's just a bunch of things you don't like about phones. What on earth does A5/1 have to do with any of these issues? Cracking A5/1 keys doesn't break your IP sessions.

Re: Show HN: Kryptonite – a new home for your SSH private key

#173

Post by j_s »

xaduha wrote: post #160

Looks like you're using pkcs11 instead of inventing your own stuff, so kudos for that at least. But I wish people would be aware of smartcards more, they are all around us, but sort of invisible and unnoticed. 1. But cheap blank "Java" smartcards, more or less disposable 2. Install this applet on it https://github.com/philipWendland/IsoApplet 3. Works with OpenSC

Is it possible to use a chip/EMV credit card as an X.509 certificate? Let the credit card company know your private key (paranoid assumption; not necessarily true) & skip straight to step 3!

Re: Show HN: Kryptonite – a new home for your SSH private key

#174

Post by forgotpwtomain »

claudius wrote: post #156
agrinman wrote: post #128

Earlier quoted context omitted.

The problem is that your private key stored in ~/.ssh/id_rsa can be read by any user-level application. The private key is even vulnerable if you passphrase encrypt it. See our deep dive into the threat model: https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9... This is why we move it off the computer and onto a phone. The security is comparable to using a Yubikey. I'm not sure why you say your phone is le…

Neither Google nor Apple have root access on a Yubikey, nor does that key have some sort of wireless transmitter included which would allow for unnoticed data transfer to or from the key. Furthermore, it is nowadays largely trivial to set up sandboxing within a single user (using SELinux, Apparmor or whatever else) or to use multiple users and classical privilege separation to achieve the same effect. It is also tell…

Thanks for the one sane post in this thread, as opposed to the iPhone is more secure than your Linux desktop FUD that tptacek seems to be spreading here.

Re: Show HN: Kryptonite – a new home for your SSH private key

#175

Post by johncolanduoni »

floatboth wrote: post #167
johncolanduoni wrote: post #165

Earlier quoted context omitted.

You're confusing the App Store and Gatekeeper. If you register for Apple's developer program they'll issue you a certificate that you can use to sign and distribute your applications outside the App Store, with no input or restrictions from Apple, while bypassing that checkbox. These applications are the majority that aren't required to be sandboxed, and rarely are.

IIRC (haven't used modern Macs in a while) Gatekeeper has three modes — allow App Store only, allow App Store + signed outside, allow all (unsigned) apps. Didn't they switch to the first one by default??

The most recent OSX version (Sierra) made the change of hiding the option that totally disabled Gatekeeper, but the default hasn't changed. I have a Sierra VM I set up about a month ago, and I just checked the setting and it's at "App Store and identified developers".

Re: Show HN: Kryptonite – a new home for your SSH private key

#176

Post by Ajedi32 »

pquerna wrote: post #34
4kevinking wrote: post #2

Hey HN! We've built a way to generate an SSH key on your phone and use it from your computer such that the private key never leaves the phone. We were inspired by the threat model of USB HSMs like the Yubikey and set out to build a free, public source, and easier to use BYOD alternative. Looking forward to your questions!

I love the transparency of having your source on Github, but the license ambiguity isn't ideal when revealing this to the world: We are currently working on a new license for Kryptonite. For now, the code is released under All Rights Reserved. https://github.com/KryptCo/kr#license Soon as I see that, I've got to close the tab, so does anyone who cares about IP. (disclaimer: i'm a co-founder of ScaleFT)

How's that ambiguous? The code is proprietary; all rights reserved.

Seems like they're planning to change that in the future, but in the meantime the existing license seems pretty clear to me.

Re: Show HN: Kryptonite – a new home for your SSH private key

#177

Post by forgotpwtomain »

agrinman wrote: post #128
lucb1e wrote: post #125

In terms of possible compromise, I rate the possibility that my phone is compromised way higher than my laptop. Adding a factor is a good idea in terms of security (not in terms of availability and ease of use, but definitely in security), but replacing it entirely... No. Why'd I even want to remove id_rsa? What's the problem being solved here?

The problem is that your private key stored in ~/.ssh/id_rsa can be read by any user-level application. The private key is even vulnerable if you passphrase encrypt it. See our deep dive into the threat model: https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9... This is why we move it off the computer and onto a phone. The security is comparable to using a Yubikey. I'm not sure why you say your phone is le…

From your blog:

  If you have a passphrase encrypted key, you can see this for yourself:

  $ eval `ssh-agent` # make sure an empty agent is running
  $ ssh user@server  # enter passphrase on first login
  $ ssh user@server  # passphrase no longer needed
This is wrong. Keys not added explicitly with `ssh-add` to ssh-agent will not be available unless you explicitly enabled AddKeysToAgent in ssh_config. [0]

Forgetting something like enabled config options is nothing uncommon for a user, but it doesn't exactly speak well for a company making an ssh-agent alternative as a product. Also I tend to agree with the poster adjacent to me which emphasized the inadequate threat model analysis in your blog post, including entirely ignoring or failing to address critical points.

[0] https://www.freebsd.org/cgi/man.cgi?query=ssh_config&sektion...

Re: Show HN: Kryptonite – a new home for your SSH private key

#178

Post by h4waii »

tptacek wrote: post #168
h4waii wrote: post #124

Earlier quoted context omitted.

Also respectfully, he stated patched daily. Generally, security updates for both iOS and Android devices happen in a monthly roll-up. If your checklist for being "secure" involves being up-to-date, there is no amount of 'getting a better phone' that will put it on par with a desktop OS that receives daily patches.

This is simply not true. No matter how often you patch your Linux desktop, it is less secure than an iPhone.

Conflating secure with up-to-date is wrong in such a broad and sweeping statement such as 'your Linux desktop is always less secure than an iPhone'.

Updates software does not instantly mean more secure, which I am sure you are aware of.

As you stated, for the generalists, yes, an out-of-the-box iPhone has more hardening than an OOTB Linux desktop, but for the type of person on HN, this is not necessarily true at all. There are too many variables.

Re: Show HN: Kryptonite – a new home for your SSH private key

#179

Post by Sir_Cmpwn »

tptacek wrote: post #171
jancsika wrote: post #159

Earlier quoted context omitted.

So if I buy such a phone, what is the relationship between the baseband chip/OS and all the bullet points you listed above? https://www.fsf.org/blogs/community/replicant-developers-fin... It's a real pain, but I can buy a laptop/desktop that doesn't have Intel ME (or its AMD equivalent) running on it. But there's no such thing as a working phone without a baseband OS. And AFAICT there isn't a single available baseban…

Use a Google or Apple phone and stop worrying about their basebands, which are effectively USB peripherals.

The radio typically has DMA on the primary CPU, and remotely exploitable vulnerabilities.

Re: Show HN: Kryptonite – a new home for your SSH private key

#180

Post by sp0ck »

jaytaylor wrote: post #36
4kevinking wrote: post #2

Hey HN! We've built a way to generate an SSH key on your phone and use it from your computer such that the private key never leaves the phone. We were inspired by the threat model of USB HSMs like the Yubikey and set out to build a free, public source, and easier to use BYOD alternative. Looking forward to your questions!

For one of the main repos: https://github.com/KryptCo/kr 57% Go 40% Rust First time I've seen them paired together in the wild like this, very cool!

Those two languages are lowering attack surface by huge factor ! :) What a amazing combination.
Post reply on HN