Krypton: phone-based U2F Authenticator • Hacker News Board

Re: Krypton: phone-based U2F Authenticator

#11

Post by xpaulbettsx » Thu, Aug 30, 2018, 5:40 PM UTC

jrockway wrote: post #5

What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…

If anything, a commercial security product that allows anyone to audit the source code seems like a pretty Useful Pattern

Re: Krypton: phone-based U2F Authenticator

#12

Post by amingilani » Thu, Aug 30, 2018, 5:46 PM UTC

This is going to change everything for me. You sirs, have cracked the hard problem: how do we make U2F easy enough for users to use without taking away the "something you have" aspect of it.

This is brilliant. I love it!

Now please fix the licensing, make the core open-source, be a bit more transparent, and get audited. It would really inspire a lot more confidence in a tool whose target audience is currently the security paranoid crowd.

Re: Krypton: phone-based U2F Authenticator

#13

Post by ecesena » Thu, Aug 30, 2018, 5:50 PM UTC

jiveturkey wrote: post #4

but does it work for browsing on the phone itself? if so, slam dunk. even without that, it is what U2F was always destined to become. it's especially better than u2fzero. ;)

> it's especially better than u2fzero. ;)

genuinely curious: why? (disclaimer: I'm working on Solo, the successor of u2fzero)

Re: Krypton: phone-based U2F Authenticator

#14

Post by microtonal » Thu, Aug 30, 2018, 5:54 PM UTC

amingilani wrote: post #12

This is going to change everything for me. You sirs, have cracked the hard problem: how do we make U2F easy enough for users to use without taking away the "something you have" aspect of it. This is brilliant. I love it! Now please fix the licensing, make the core open-source, be a bit more transparent, and get audited. It would really inspire a lot more confidence in a tool whose target audience is currently the sec…

I thought they already open source various parts, including the command-line client, iOS and Android applications?

https://github.com/kryptco

Edit: I didn't realize that they publish the source code, but with a non-FLOSS license.

Re: Krypton: phone-based U2F Authenticator

#15

Post by ecesena » Thu, Aug 30, 2018, 5:55 PM UTC

ademup wrote: post #6

Has this been audited? It sure seems like a wonderful/convenient alternative to hardware keys, but something makes me nervous about the phone aspect. I'd love to read more comments here from those more knowledgeable than I.

It doesn't seem this can really be FIDO, because FIDO only defines usb, nfc, and ble security keys.

I'm not saying Krypton is bad, just that you're installing an extension that (I imagine) interacts with a server to send a push to your phone. It's a very different security model than keys, that require no extension and don't interact with any 3rd party.

Update: I'm seeing that my comment is read as negative, and I don't want to give this impression. I think Krypton is great, I use 2FA over push notifications all the times myself. I was just trying to reply to the "has it been audited?" question.

Edit: changed chrome extension -> extension according to comment below.

Re: Krypton: phone-based U2F Authenticator

#16

Post by jonafato » Thu, Aug 30, 2018, 5:58 PM UTC

Can anyone comment on their "zero touch is safe" claim (https://krypt.co/faq/)? As far as I understand, tokens like YubiKeys require a touch as an explicit action by the user to prevent authentication without their knowledge. Doesn't a zero touch approach remove a security feature?

Re: Krypton: phone-based U2F Authenticator

#17

Post by davefp » Thu, Aug 30, 2018, 5:59 PM UTC

jrockway wrote: post #5

What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…

On their FAQ page they state that their app is 'public source'. I assume that is so you (or presumably your organization) can audit (rather than debug) it if necessary.

I've not tried it, but they also suggest you can compile your own binaries from that source to get around the untrusted binary problem.

Re: Krypton: phone-based U2F Authenticator

#18

Post by dsr_ » Thu, Aug 30, 2018, 6:02 PM UTC

xpaulbettsx wrote: post #11

jrockway wrote: post #5

What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…

If anything, a commercial security product that allows anyone to audit the source code seems like a pretty Useful Pattern

...only if you can prove that the source code you show them builds the binary that you install, every single time.

Re: Krypton: phone-based U2F Authenticator

#19

Post by henryfjordan » Thu, Aug 30, 2018, 6:05 PM UTC

jonafato wrote: post #16

Can anyone comment on their "zero touch is safe" claim ( https://krypt.co/faq/ )? As far as I understand, tokens like YubiKeys require a touch as an explicit action by the user to prevent authentication without their knowledge. Doesn't a zero touch approach remove a security feature?

It depends on your threat model.

You pair your phone and browser and then they can talk. Any time you want to log in through that browser it can talk to your phone and auth you automatically. For someone to exploit this, they'd need access to the computer with your browser.

So if your laptop gets stolen, yes this is a bad idea, but I think most people think that they can just revoke the browser's keys if if the laptop gets stolen and they are way more likely to have their phone stolen anyway.

Re: Krypton: phone-based U2F Authenticator

#20

Post by orclev » Thu, Aug 30, 2018, 6:11 PM UTC

mikekij wrote: post #9

orclev wrote: post #3

I've been using it for about a year now. Works very well. Only gotcha is that it doesn't really have support for Windows (it's on the issue tracker, but progress has been slow). If you do your work on OS X or Linux you're fine, but if you're a Windows user you're in for a bumpy ride.

Side thought- what an interesting change from the software world 10 years ago. Who would have thought windows support was a lower priority then OS X and Linux. Onward and upward!

In this particular case it's all about Windows not having a decent SSH client. There's PuTTY... and uh... PuTTY. Oh, and you can sort of maybe run OpenSSH through LSFW or Cygwin, or maybe msys, but those all have some serious gotchas associated with them. Basically it boils down to, there's no standard Windows SSH client, and the ones that are available all have a laundry list of gotchas and problems, and that's without even bringing in the various git clients into consideration. OS X and Linux are low hanging fruit, they both come out of the box with a standard and well supported SSH clients.