Live data from Hacker News

Show HN: Kryptonite – a new home for your SSH private key

krypt.co

131–140 of 227 posts

Re: Show HN: Kryptonite – a new home for your SSH private key

#131

Earlier quoted context omitted.

> y4 is one more thing to worry about. to lose. to have stolen. to drop in the toilet. etc. How is this different from your phone?

Presumably most of the people in this thread already have a smartphone. So it isn't really one _more_ thing.

Most of us have a keyring too - and losing that is a major pain in the ass. FOr me - I'd say my wallet/keys/phone are the objects I own that are "most secure".

Re: Show HN: Kryptonite – a new home for your SSH private key

#132
post #125

In terms of possible compromise, I rate the possibility that my phone is compromised way higher than my laptop. Adding a factor is a good idea in terms of security (not in terms of availability and ease of use, but definitely in security), but replacing it entirely... No. Why'd I even want to remove id_rsa? What's the problem being solved here?

Unrooted Android and iOS are much more secure than Windows or common UNIX variants. Mac OS X has similar sandboxing, but few people only use sandboxed apps. I guess the same can be true for Windows with store apps

Re: Show HN: Kryptonite – a new home for your SSH private key

#133
post #132
post #125

In terms of possible compromise, I rate the possibility that my phone is compromised way higher than my laptop. Adding a factor is a good idea in terms of security (not in terms of availability and ease of use, but definitely in security), but replacing it entirely... No. Why'd I even want to remove id_rsa? What's the problem being solved here?

Unrooted Android and iOS are much more secure than Windows or common UNIX variants. Mac OS X has similar sandboxing, but few people only use sandboxed apps. I guess the same can be true for Windows with store apps

I don't think OS X's sandboxing has seen nearly as much scrutiny as the iOS/Android counterparts. An OS X sandbox escape buys you barely anything since the vast majority of apps don't come form the Mac App Store and don't bother enabling it. I wouldn't put a whole lot of faith in it.

Re: Show HN: Kryptonite – a new home for your SSH private key

#134
post #130
post #34

Earlier quoted context omitted.

I love the transparency of having your source on Github, but the license ambiguity isn't ideal when revealing this to the world: We are currently working on a new license for Kryptonite. For now, the code is released under All Rights Reserved. https://github.com/KryptCo/kr#license Soon as I see that, I've got to close the tab, so does anyone who cares about IP. (disclaimer: i'm a co-founder of ScaleFT)

Is proprietary code even allowed on GitHub?

Yes

Re: Show HN: Kryptonite – a new home for your SSH private key

#135

Earlier quoted context omitted.

Presumably most of the people in this thread already have a smartphone. So it isn't really one _more_ thing.

Most of us have a keyring too - and losing that is a major pain in the ass. FOr me - I'd say my wallet/keys/phone are the objects I own that are "most secure".

i'm keyless and loving it, true most aren't

Re: Show HN: Kryptonite – a new home for your SSH private key

#136
post #130
post #34

Earlier quoted context omitted.

I love the transparency of having your source on Github, but the license ambiguity isn't ideal when revealing this to the world: We are currently working on a new license for Kryptonite. For now, the code is released under All Rights Reserved. https://github.com/KryptCo/kr#license Soon as I see that, I've got to close the tab, so does anyone who cares about IP. (disclaimer: i'm a co-founder of ScaleFT)

Is proprietary code even allowed on GitHub?

You grant some rights to other users of GitHub, but I'm not seeing anything that prevents proprietary code:

> If you set your pages and repositories to be viewed publicly, you grant each User of GitHub a nonexclusive, worldwide license to access your Content through the GitHub Service, and to use, display and perform your Content, and to reproduce your Content solely on GitHub as permitted through GitHub's functionality. You may grant further rights if you adopt a license.

https://help.github.com/articles/github-terms-of-service/

To anyone more versed in US law than me, what usage specifically does "use, display and perform your Content" permit?

Re: Show HN: Kryptonite – a new home for your SSH private key

#137
post #83

Earlier quoted context omitted.

That sounds more like a flawed phone.

... Exactly my point?

There are better phones out there, and nobody is stopping you from using them. You can't say this app/service is flawed just because some people might use a flawed phone.

Re: Show HN: Kryptonite – a new home for your SSH private key

#138
I have read through the FAQ and many of the comments on the thread. They seem rational to me. I have mixed feelings about this, mostly around the emotional inertia for changing something.

On the other hand, I can see an immediate use-case for this for me. I use mosh to log into my cloud dev environment and since mosh doesn't support ssh-agent forwarding (and unlikely to ever to support it) ... this seems much a much better alternative.

Re: Show HN: Kryptonite – a new home for your SSH private key

#139

Earlier quoted context omitted.

Most of us have a keyring too - and losing that is a major pain in the ass. FOr me - I'd say my wallet/keys/phone are the objects I own that are "most secure".

i'm keyless and loving it, true most aren't

So I have 4 motorcycles each with it's own key/keyring, my house keys, and my work keys. I've almost _always_ got three keyrings in my pocket.
Post reply on HN