Very cool!
Show HN: Kryptonite – a new home for your SSH private key
101–110 of 227 posts
Re: Show HN: Kryptonite – a new home for your SSH private key
#102Very cool!
Re: Show HN: Kryptonite – a new home for your SSH private key
#103Clever that it uses the client instead of the server! I've dabbled with phone-based authentication via a server-side PAM module before, but you generally don't have full control over the servers you SSH into. Although the question remains: is this more secure than just storing your key on your computer? If you're assuming your machine to be compromised, then as soon as you login to another server you've basically giv…
You've hit the nail on the head. If your computer's ssh binary can be compromised so can krd.
If the main objective is to prevent other apps in user space from reading unlocked private keys, why not just ssh/sudo into a secondary account where the default shell is set to an ssh client?
Re: Show HN: Kryptonite – a new home for your SSH private key
#104Earlier quoted context omitted.
What specifically do you consider a gigantic pain in the ass about using SSH keys on a Yubikey? Also, how is keeping the private key ensconced in a (presumably) secure HSM a 'bit of security theatre'? Genuinely interested, here.
y4 is one more thing to worry about. to lose. to have stolen. to drop in the toilet. etc. i think part of the "theatre" is the whole convenience for safety thing. a few years ago it was gospel to change your passwords all the time. then some data started to point to this actually might be bad because it forced users into to using easy to remember things like sequences, or write them down (often in something like note…
> y4 is one more thing to worry about. to lose. to have stolen. to drop in the toilet. etc.
How is this different from your phone?
Re: Show HN: Kryptonite – a new home for your SSH private key
#105Earlier quoted context omitted.
1. You have to upload your Kryptonite public key to ~/.ssh/authorized_keys on all the servers you want to access with your Kryptonite key. Take a look at the unlisted command `kr add`to help with this. It automatically adds your kryptonite public key to a server you specify: i.e. `kr add user@server` add your Kryptonite public key to the authorized_keys file for account `user` on `server`. 2. It does actually. All yo…
Ah! Great - thank you. Overall, I am amazed at the simplicity of managing keys using this platform.
Well as of now it apparently manages one key.
Re: Show HN: Kryptonite – a new home for your SSH private key
#106Looks interesting. However, it seems to maybe assume you're using bash? Using the fish-shell it seems to have simply broken ssh and git operations with incorrect syntax. I had to run `kr uninstall` to get things back to normal (it fails when it's running fish or if I drop into bash so it's somehow looking at my default shell.) I submitted a ticket on the repo.
Thanks, will fix this asap. We have tested on bash, zsh, and fish on macOS but it seems we missed an edge case. I'll follow up with your ticket.
came here to make note of this as well. thanks for the prompt fix, i'll check it out again in a couple of days :)
Re: Show HN: Kryptonite – a new home for your SSH private key
#107Earlier quoted context omitted.
What specifically do you consider a gigantic pain in the ass about using SSH keys on a Yubikey? Also, how is keeping the private key ensconced in a (presumably) secure HSM a 'bit of security theatre'? Genuinely interested, here.
The agent process is tricky to set up and persnickety, especially if you use the token for anything else besides SSH. At one point, before I tableflipped and switched back to software keys, I had to switch agent processes any time I used my Y4 to sign into a VPN. The theater is that you're protecting a key but not the account the key protects . Yes, you'll never lose the actual RSA key bits to an attacker. But that'l…
>Yes, you'll never lose the actual RSA key bits to an attacker. But that'll be cold comfort after an attacker uses a hijacked SSH process to compromise every account you log into.
But if you enable (and require) the touch feature, it'll be pretty obvious if someone's trying to use your agent to authenticate somewhere else, no? I'd certainly notice if I had to press the button twice while I'm logging into a machine that should only request auth once (i.e. I'm not proxying through another box).
Re: Show HN: Kryptonite – a new home for your SSH private key
#108I love the concept, but I think the added complexity is hard to trust, at least for now.
Re: Show HN: Kryptonite – a new home for your SSH private key
#109Earlier quoted context omitted.
Not to mention the vast majority of android devices have vulnerable wifi firmware, that will never be updated. Somehow fans of phone security think there is nothing strange about replacing a phone every 12 months to keep receiving updates...
What's really happening is that fans of phone security want to say "iPhone" rather than "phone", but when they do that on HN, Linux-on-the-desktop Android supporters come out of the woodwork to yell at them, and it's a winnable argument on a thread that is only about whether iPhones are more secure than Android phones, but not on broader threads where it's just an enormous distraction. As you can see from this thread…
Agreed. Until the last year or so there was not a single Android OS+Hardware combo that basically had the same full file based encryption capabilities of iOS 4.0. 4 .... dot .... zero. It took some super small subset of Android to reach the security of iOS 5 years ago. I think (think!) Pixel comes close to having most of the features of Secure Enclave -- but you can hardly wave one of the most recent and expensive Android devices around and say "Android is as secure as iOS"... Odds are almost certain any Android phone a consumer will buy today will have far less platform security than iOS.
Re: Show HN: Kryptonite – a new home for your SSH private key
#110Earlier quoted context omitted.
Not to mention the vast majority of android devices have vulnerable wifi firmware, that will never be updated. Somehow fans of phone security think there is nothing strange about replacing a phone every 12 months to keep receiving updates...
What's really happening is that fans of phone security want to say "iPhone" rather than "phone", but when they do that on HN, Linux-on-the-desktop Android supporters come out of the woodwork to yell at them, and it's a winnable argument on a thread that is only about whether iPhones are more secure than Android phones, but not on broader threads where it's just an enormous distraction. As you can see from this thread…
Since Kryptonite is available for Android phones, it's a point at least worth highlighting.
One might think that anyone savvy enough to want an app to manage his ssh private keys would also think about his phone's security. In practice, from my observation, a lot of people who have to use ssh keys don't really understand them and would not think twice about loading an app like this onto their Android phones, alongside all manner of ad-laden apps of unknown quality or provenance.
I myself use an Android phone. But I assume it's not secure.