Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Kryptonite – a new home for your SSH private key

krypt.co

Post reply on HN
Print view View original

11–20 of 227 posts

Re: Show HN: Kryptonite – a new home for your SSH private key

#13

Post by 4kevinking »

eof wrote: post #4

Why do I want my private key on my phone instead of the computer where I am using it?

Any user-level application on your computer can read the SSH key -- you'll never know if it's used or sent off somewhere. Even passphrase encrypted keys are vulnerable. Check out this blog post for a deep dive on our threatmodel and why you should store your SSH key on your phone https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9...

Re: Show HN: Kryptonite – a new home for your SSH private key

#14

Post by falcolas »

4kevinking wrote: post #2

Hey HN! We've built a way to generate an SSH key on your phone and use it from your computer such that the private key never leaves the phone. We were inspired by the threat model of USB HSMs like the Yubikey and set out to build a free, public source, and easier to use BYOD alternative. Looking forward to your questions!

The Yubikey (as in generate and store SSH keys on the Yubikey) is not exactly a hard to use option. It's not as nicely packaged, but quite functional.

EDIT: I'd love to talk about this, if someone has a differing opinion. Once set up, it was dirt simple to use.

Re: Show HN: Kryptonite – a new home for your SSH private key

#15

Post by 4kevinking »

akerl_ wrote: post #5

Are the communications between the phone and the computer going via the kryptonite servers?

No -- we treat every communication channel as untrusted. All communication between the phone and computer is encrypted with session keys established when you pair by scanning the QR code in the terminal. Check out our architecture post for more details: https://blog.krypt.co/the-kryptonite-architecture-a385e7aaa3...

Re: Show HN: Kryptonite – a new home for your SSH private key

#16

Post by daveloyall »

falcolas wrote: post #8
eof wrote: post #4

Why do I want my private key on my phone instead of the computer where I am using it?

Even if your computer is 100% compromised, SSH can't be used without your explicit permission and knowledge.

I think you're saying that if you use this app, and remove other ssh keys from your computer, then "SSH can't be used without your explicit permission and knowledge.".

I agree with another commentator, I trust my PC more than I trust my phone. The latter is probably already compromised.

Re: Show HN: Kryptonite – a new home for your SSH private key

#17

Post by newman314 »

4kevinking wrote: post #2

Hey HN! We've built a way to generate an SSH key on your phone and use it from your computer such that the private key never leaves the phone. We were inspired by the threat model of USB HSMs like the Yubikey and set out to build a free, public source, and easier to use BYOD alternative. Looking forward to your questions!

Some questions & comments:

* Can you have multiple private keys (site specific?)?

* Does the Android client support ed25519 keys or is it iOS only?

* Please modify your curl statement to be something like how Honeycomb does it (that is include a checksum test). https://honeycomb.io/docs/connect/nginx/

Re: Show HN: Kryptonite – a new home for your SSH private key

#18

Post by 4kevinking »

daveloyall wrote: post #11

Does this allow me to ssh into my server, for example, a shell server on the internet? If so, how does the server contact my phone? Through your server, right? What software do I install on the server for that?

Kryptonite allows you to use SSH on your computer, but authenticate with a private key protected on your phone. It doesn't require any changes to the server, just the Kryptonite app and our workstation software.

Re: Show HN: Kryptonite – a new home for your SSH private key

#19

Post by daveloyall »

daveloyall wrote: post #11

Does this allow me to ssh into my server, for example, a shell server on the internet? If so, how does the server contact my phone? Through your server, right? What software do I install on the server for that?

I found the answer on your blog:

    > Our system consists of three components:
    >   (1) the Kryptonite phone app for iOS and Android,
    >   (2) the krd daemon that runs in the background on a macOS or Linux computer, and
    >   (3) the kr command line utility that manages krd.
...from https://blog.krypt.co/the-kryptonite-architecture-a385e7aaa3...

Sounds like `krd` is why I likely won't be using this.

Try implementing it as a PAM module or something.

[edit: formatting]

Re: Show HN: Kryptonite – a new home for your SSH private key

#20

Post by akerl_ »

4kevinking wrote: post #15
akerl_ wrote: post #5

Are the communications between the phone and the computer going via the kryptonite servers?

No -- we treat every communication channel as untrusted. All communication between the phone and computer is encrypted with session keys established when you pair by scanning the QR code in the terminal. Check out our architecture post for more details: https://blog.krypt.co/the-kryptonite-architecture-a385e7aaa3...

If I'm reading this, the answer is actually ~Yes? The requests pass via SQS/SNS run by Kryptonite, or via Bluetooth not run by kryptonite?
Post reply on HN