Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Kryptonite – a new home for your SSH private key

krypt.co

Post reply on HN
Print view View original

61–70 of 227 posts

Re: Show HN: Kryptonite – a new home for your SSH private key

#61

Post by dv_dt »

tptacek wrote: post #46
shmel wrote: post #33

It sounds very hipster and all, but how is a phone more trustworthy than a Linux PC? Cool, we don't need to trust a PC, now we have to trust a phone and pretend that malware for smartphones don't exist at all. Hardware USB token looks much better as its attack surface is so much smaller than iOS/Android.

* Every application on the phone is sandboxed. * The disk is encrypted by default, and the OS is aggressive about keeping it encrypted ; a booted-up computer is almost always decrypted. * The language runtimes on the phone are hardened. * The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. * The phone's us…

I thought the big fundamental vulnerability was that many baseband processors operating the phone's radio has dma to the memory of the entire device.

Re: Show HN: Kryptonite – a new home for your SSH private key

#62

Post by packetized »

tptacek wrote: post #46
shmel wrote: post #33

It sounds very hipster and all, but how is a phone more trustworthy than a Linux PC? Cool, we don't need to trust a PC, now we have to trust a phone and pretend that malware for smartphones don't exist at all. Hardware USB token looks much better as its attack surface is so much smaller than iOS/Android.

* Every application on the phone is sandboxed. * The disk is encrypted by default, and the OS is aggressive about keeping it encrypted ; a booted-up computer is almost always decrypted. * The language runtimes on the phone are hardened. * The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. * The phone's us…

What specifically do you consider a gigantic pain in the ass about using SSH keys on a Yubikey? Also, how is keeping the private key ensconced in a (presumably) secure HSM a 'bit of security theatre'? Genuinely interested, here.

Re: Show HN: Kryptonite – a new home for your SSH private key

#63

Post by 4kevinking »

packetized wrote: post #59
4kevinking wrote: post #35

Earlier quoted context omitted.

The attack surface may seem smaller for USB tokens, but storing the pin for say a Yubikey allows malware to use the key without restriction. Also, these USB devices don't have a UI, so you never know what you are actually approving, i.e. which username or server you are logging into.

Erm, not true - changing the Yubikey setting to require a touch for key use (S/C/E) is trivial. Malware can't use it without restriction if it requires you to physically touch it every time you want to approve use.

Point taken. Unfortunately when you touch the key you still can't verify exactly what you are approving.

Re: Show HN: Kryptonite – a new home for your SSH private key

#64

Post by tptacek »

dv_dt wrote: post #61
tptacek wrote: post #46

Earlier quoted context omitted.

* Every application on the phone is sandboxed. * The disk is encrypted by default, and the OS is aggressive about keeping it encrypted ; a booted-up computer is almost always decrypted. * The language runtimes on the phone are hardened. * The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. * The phone's us…

I thought the big fundamental vulnerability was that many baseband processors operating the phone's radio has dma to the memory of the entire device.

This is a myth.

Re: Show HN: Kryptonite – a new home for your SSH private key

#65

Post by xg15 »

The faq says there is intentionally no way to extract the private key due to security. But this means I need a second account in case my phone gets lost - the key of which I once again need to secure.

How is that more secure than letting me backup the private key in the first place?

Re: Show HN: Kryptonite – a new home for your SSH private key

#66

Post by tptacek »

packetized wrote: post #62
tptacek wrote: post #46

Earlier quoted context omitted.

* Every application on the phone is sandboxed. * The disk is encrypted by default, and the OS is aggressive about keeping it encrypted ; a booted-up computer is almost always decrypted. * The language runtimes on the phone are hardened. * The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. * The phone's us…

What specifically do you consider a gigantic pain in the ass about using SSH keys on a Yubikey? Also, how is keeping the private key ensconced in a (presumably) secure HSM a 'bit of security theatre'? Genuinely interested, here.

The agent process is tricky to set up and persnickety, especially if you use the token for anything else besides SSH. At one point, before I tableflipped and switched back to software keys, I had to switch agent processes any time I used my Y4 to sign into a VPN.

The theater is that you're protecting a key but not the account the key protects. Yes, you'll never lose the actual RSA key bits to an attacker. But that'll be cold comfort after an attacker uses a hijacked SSH process to compromise every account you log into.

There's some value to the Y4 SSH key, don't get me wrong. It's just much less value than you'd expect from all the ceremony.

Re: Show HN: Kryptonite – a new home for your SSH private key

#67

Post by rileytg »

packetized wrote: post #62
tptacek wrote: post #46

Earlier quoted context omitted.

* Every application on the phone is sandboxed. * The disk is encrypted by default, and the OS is aggressive about keeping it encrypted ; a booted-up computer is almost always decrypted. * The language runtimes on the phone are hardened. * The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. * The phone's us…

What specifically do you consider a gigantic pain in the ass about using SSH keys on a Yubikey? Also, how is keeping the private key ensconced in a (presumably) secure HSM a 'bit of security theatre'? Genuinely interested, here.

y4 is one more thing to worry about. to lose. to have stolen. to drop in the toilet. etc.

i think part of the "theatre" is the whole convenience for safety thing. a few years ago it was gospel to change your passwords all the time. then some data started to point to this actually might be bad because it forced users into to using easy to remember things like sequences, or write them down (often in something like notes app or under keyboard on a sticky).

while this may not be the good for military gov etc, it's probably a lot better for average joes. by making it easier to have pretty good security method, i can reasonably expect my users to stop doing stupid shit like keeping their keys on google drive (because "wernt you the guy who made us use drive because it's more secure than ftp?!"- yes many users are petty like that).

Re: Show HN: Kryptonite – a new home for your SSH private key

#68

Post by rileytg »

tptacek wrote: post #66
packetized wrote: post #62

Earlier quoted context omitted.

What specifically do you consider a gigantic pain in the ass about using SSH keys on a Yubikey? Also, how is keeping the private key ensconced in a (presumably) secure HSM a 'bit of security theatre'? Genuinely interested, here.

The agent process is tricky to set up and persnickety, especially if you use the token for anything else besides SSH. At one point, before I tableflipped and switched back to software keys, I had to switch agent processes any time I used my Y4 to sign into a VPN. The theater is that you're protecting a key but not the account the key protects . Yes, you'll never lose the actual RSA key bits to an attacker. But that'l…

totally agreed on agent. also on provisioning the keys. my windows users eyes, even the more technical of the bunch, glaze over when teaching intro to your yubi key

Re: Show HN: Kryptonite – a new home for your SSH private key

#69

Post by rileytg »

dv_dt wrote: post #61
tptacek wrote: post #46

Earlier quoted context omitted.

* Every application on the phone is sandboxed. * The disk is encrypted by default, and the OS is aggressive about keeping it encrypted ; a booted-up computer is almost always decrypted. * The language runtimes on the phone are hardened. * The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. * The phone's us…

I thought the big fundamental vulnerability was that many baseband processors operating the phone's radio has dma to the memory of the entire device.

pls explain

Re: Show HN: Kryptonite – a new home for your SSH private key

#70

Post by detaro »

xg15 wrote: post #65

The faq says there is intentionally no way to extract the private key due to security. But this means I need a second account in case my phone gets lost - the key of which I once again need to secure. How is that more secure than letting me backup the private key in the first place?

Not everything needs a key backup. If you create a backup key, you can create it on another device (ideally the one it's going to be used from) and don't have to move it off the phone in a way where it could be exposed (As much as one would think people using stuff like this should know better, I wouldn't be surprised if at least some got the backup off their phone by e-mailing it to themselves or something along those lines)
Post reply on HN