91–100 of 227 posts
Hey HN! We've built a way to generate an SSH key on your phone and use it from your computer such that the private key never leaves the phone. We were inspired by the threat model of USB HSMs like the Yubikey and set out to build a free, public source, and easier to use BYOD alternative. Looking forward to your questions!
Earlier quoted context omitted.
>>> The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. Most android phones are not updatable at all since manufacturers don't publish any update. That, alone, should be enough to put phones among the most vulnerable devices on the planet.
Not to mention the vast majority of android devices have vulnerable wifi firmware, that will never be updated. Somehow fans of phone security think there is nothing strange about replacing a phone every 12 months to keep receiving updates...
As you can see from this thread, some people are bored and just want the distraction and will go out of their way to revive the slapfight.
Despite having friends working hard to deliver a secure Android phone for Google, my advice to generalists is the same as yours: avoid Android.
Earlier quoted context omitted.
What specifically do you consider a gigantic pain in the ass about using SSH keys on a Yubikey? Also, how is keeping the private key ensconced in a (presumably) secure HSM a 'bit of security theatre'? Genuinely interested, here.
The agent process is tricky to set up and persnickety, especially if you use the token for anything else besides SSH. At one point, before I tableflipped and switched back to software keys, I had to switch agent processes any time I used my Y4 to sign into a VPN. The theater is that you're protecting a key but not the account the key protects . Yes, you'll never lose the actual RSA key bits to an attacker. But that'l…
Added bonus is that not only does it work with SSH, but you can use those certificates for TLS mutual authentication in web browsers. Works out of the box on Mac/Windows.
I submitted a ticket on the repo.
Looks interesting. However, it seems to maybe assume you're using bash? Using the fish-shell it seems to have simply broken ssh and git operations with incorrect syntax. I had to run `kr uninstall` to get things back to normal (it fails when it's running fish or if I drop into bash so it's somehow looking at my default shell.) I submitted a ticket on the repo.
So the new way to secure your private keys is in a location you DON'T control and validation by text message? It's May 1st not April 1st.
I haven't reviewed the implementation, but this is a really good idea. I want one.
I will likely end up using this in personal capacity, and would also appreciate if the UX of using Google Authenticator were more similar to this, rather than requiring me to screenscrape my phone with my eyeball and then type information into another device (or, more painfully, another window on the same phone). The easiest way to do that probably results in a callback to Big Daddy G every time I access anything sen…
Although the security of cloud copy-paste I haven't investigated...
Earlier quoted context omitted.
>>> The phone's kernel, in addition to being more important attack surface than the Linux kernel (because of the jailbreak market, among other things), is auto-updated. Most android phones are not updatable at all since manufacturers don't publish any update. That, alone, should be enough to put phones among the most vulnerable devices on the planet.
It puts those Android phones among the more vulnerable devices. Don't use those Android phones. I recommend iPhones to anyone concerned about security, but you can substitute the Google phone of your choice; I don't want the argument today.