Krypton: phone-based U2F Authenticator

#1

Post by cyanflux » Thu, Aug 30, 2018, 4:41 PM UTC

Krypton: phone-based U2F Authenticator
krypt.co

Re: Krypton: phone-based U2F Authenticator

#2

Post by phren0logy » Thu, Aug 30, 2018, 5:10 PM UTC

I have been experimenting with this since I saw it here on HN a while ago. So far, I'm impressed.

Re: Krypton: phone-based U2F Authenticator

#3

Post by orclev » Thu, Aug 30, 2018, 5:17 PM UTC

I've been using it for about a year now. Works very well. Only gotcha is that it doesn't really have support for Windows (it's on the issue tracker, but progress has been slow). If you do your work on OS X or Linux you're fine, but if you're a Windows user you're in for a bumpy ride.

Re: Krypton: phone-based U2F Authenticator

#4

Post by jiveturkey » Thu, Aug 30, 2018, 5:29 PM UTC

but does it work for browsing on the phone itself? if so, slam dunk.

even without that, it is what U2F was always destined to become.

it's especially better than u2fzero. ;)

Re: Krypton: phone-based U2F Authenticator

#5

Post by jrockway » Thu, Aug 30, 2018, 5:33 PM UTC

What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled binaries, I don't see the value to anyone.

Re: Krypton: phone-based U2F Authenticator

#6

Post by ademup » Thu, Aug 30, 2018, 5:33 PM UTC

Has this been audited? It sure seems like a wonderful/convenient alternative to hardware keys, but something makes me nervous about the phone aspect. I'd love to read more comments here from those more knowledgeable than I.

Re: Krypton: phone-based U2F Authenticator

#7

Post by CiPHPerCoder » Thu, Aug 30, 2018, 5:36 PM UTC

jrockway wrote: post #5

What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…

https://github.com/kryptco/krypton-android/blob/e5e1399caea4...

You weren't kidding. :(

Re: Krypton: phone-based U2F Authenticator

#8

Post by CaliforniaKarl » Thu, Aug 30, 2018, 5:36 PM UTC

Ah yes, I remember seeing this before!

This is interesting, because at work pretty much all of our logins (including for third-party services) go through SAML, where our IdPs use Duo for two-step. That gives us similar functionality to this, without needing to use a browser plugin. You do need to use an app, though, to avoid insecure SMS or voice.

(Duo does support U2F, but it's not as obvious, because end users have to initiate the setup, and Duo instances that existed before U2F became available have it turned off—instance-wide—by default.)

One thing you could do, assuming work uses Duo and U2F support is on: You could have a singly Krypton install for both personal and work (particularly if you have one mobile device). Then, enroll Krypton as your U2F device in Duo.

I'm kindof surprised that either Duo or LastPass haven't bought out krypt.co yet…

Re: Krypton: phone-based U2F Authenticator

#9

Post by mikekij » Thu, Aug 30, 2018, 5:38 PM UTC

orclev wrote: post #3

I've been using it for about a year now. Works very well. Only gotcha is that it doesn't really have support for Windows (it's on the issue tracker, but progress has been slow). If you do your work on OS X or Linux you're fine, but if you're a Windows user you're in for a bumpy ride.

Side thought- what an interesting change from the software world 10 years ago. Who would have thought windows support was a lower priority then OS X and Linux. Onward and upward!

Re: Krypton: phone-based U2F Authenticator

#10

Post by CaliforniaKarl » Thu, Aug 30, 2018, 5:38 PM UTC

CiPHPerCoder wrote: post #7

jrockway wrote: post #5

What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…

https://github.com/kryptco/krypton-android/blob/e5e1399caea4... You weren't kidding. :(

Their CONTRIBUTING file does say "We are currently researching what type of license makes the most sense for Kryptonite." On the other hand, that file was last updated on `master` in January 2017.