Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Kryptonite – a new home for your SSH private key

krypt.co

Post reply on HN
Print view View original

81–90 of 227 posts

Re: Show HN: Kryptonite – a new home for your SSH private key

#81

Post by agrinman »

cyberferret wrote: post #78

Seems pretty cool - I've just installed it and having a play with it. A couple of questions: 1. So I have to update all my servers to use my Kryptonite SSH key from the current Private Keys that I have? 2. This solution still doesn't allow me to SSH into my servers from another machine that doesn't have my private keys on it (such as a colleague's Mac), does it?

1. You have to upload your Kryptonite public key to ~/.ssh/authorized_keys on all the servers you want to access with your Kryptonite key. Take a look at the unlisted command `kr add`to help with this. It automatically adds your kryptonite public key to a server you specify: i.e. `kr add user@server` add your Kryptonite public key to the authorized_keys file for account `user` on `server`.

2. It does actually. All you need to do is pair with your colleague's mac. Run `kr pair` on their machine, Kryptonite can be paired with unlimited computers such as your work and home computers. You'll be able to ssh to all your servers using the Kryptonite key.

Re: Show HN: Kryptonite – a new home for your SSH private key

#84

Post by exabrial »

pvg wrote: post #83
exabrial wrote: post #82

I don't have root access on my phone, and Samsung only releases patches if their phones catch on fire. No thanks. Good idea though, but flawed execution.

That sounds more like a flawed phone.

... Exactly my point?

Re: Show HN: Kryptonite – a new home for your SSH private key

#85

Post by joshribakoff »

eof wrote: post #4

Why do I want my private key on my phone instead of the computer where I am using it?

I guess its like 2 factor authentication - I can let a friend use my computer & not worry about them SSHing in to my server. Or I could just create a 2nd account on the computer instead of using Kryptonite (easier in my opinion).

I also have to wonder what kinds of backdoor access the NSA has to my phone.

Re: Show HN: Kryptonite – a new home for your SSH private key

#86

Post by cyberferret »

agrinman wrote: post #81
cyberferret wrote: post #78

Seems pretty cool - I've just installed it and having a play with it. A couple of questions: 1. So I have to update all my servers to use my Kryptonite SSH key from the current Private Keys that I have? 2. This solution still doesn't allow me to SSH into my servers from another machine that doesn't have my private keys on it (such as a colleague's Mac), does it?

1. You have to upload your Kryptonite public key to ~/.ssh/authorized_keys on all the servers you want to access with your Kryptonite key. Take a look at the unlisted command `kr add`to help with this. It automatically adds your kryptonite public key to a server you specify: i.e. `kr add user@server` add your Kryptonite public key to the authorized_keys file for account `user` on `server`. 2. It does actually. All yo…

Ah! Great - thank you. Overall, I am amazed at the simplicity of managing keys using this platform.

Re: Show HN: Kryptonite – a new home for your SSH private key

#87

Post by throwaway2048 »

user5994461 wrote: post #75
tptacek wrote: post #46

Earlier quoted context omitted.

* Every application on the phone is sandboxed. * The disk is encrypted by default, and the OS is aggressive about keeping it encrypted ; a booted-up computer is almost always decrypted. * The language runtimes on the phone are hardened. * The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. * The phone's us…

>>> The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. Most android phones are not updatable at all since manufacturers don't publish any update. That, alone, should be enough to put phones among the most vulnerable devices on the planet.

Not to mention the vast majority of android devices have vulnerable wifi firmware, that will never be updated. Somehow fans of phone security think there is nothing strange about replacing a phone every 12 months to keep receiving updates...

Re: Show HN: Kryptonite – a new home for your SSH private key

#88

Post by tptacek »

user5994461 wrote: post #75
tptacek wrote: post #46

Earlier quoted context omitted.

* Every application on the phone is sandboxed. * The disk is encrypted by default, and the OS is aggressive about keeping it encrypted ; a booted-up computer is almost always decrypted. * The language runtimes on the phone are hardened. * The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. * The phone's us…

>>> The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. Most android phones are not updatable at all since manufacturers don't publish any update. That, alone, should be enough to put phones among the most vulnerable devices on the planet.

It puts those Android phones among the more vulnerable devices. Don't use those Android phones. I recommend iPhones to anyone concerned about security, but you can substitute the Google phone of your choice; I don't want the argument today.

Re: Show HN: Kryptonite – a new home for your SSH private key

#90

Post by tptacek »

dv_dt wrote: post #79
tptacek wrote: post #64

Earlier quoted context omitted.

This is a myth.

I don't understand, I'm going off of information such as this [1][2]. Do you mean that shared memory vulnerabilities described in [2] has since been closed? Or maybe I'm being imprecise with terming it "dma" access? [1] http://boingboing.net/2016/07/20/baseband-vulnerability-coul... [2] https://www.usenix.org/system/files/conference/woot12/woot12...

On modern phones --- for the last $many years --- the baseband processors are connected to the AP via things like HSIC, not DMA.

Don't ever get your security news from Boing Boing.

Post reply on HN