21–30 of 100 posts
but does it work for browsing on the phone itself? if so, slam dunk. even without that, it is what U2F was always destined to become. it's especially better than u2fzero. ;)
By reading the website it seems they are doing the same thing as Duo.
Can anyone comment on their "zero touch is safe" claim ( https://krypt.co/faq/ )? As far as I understand, tokens like YubiKeys require a touch as an explicit action by the user to prevent authentication without their knowledge. Doesn't a zero touch approach remove a security feature?
It depends on your threat model. You pair your phone and browser and then they can talk. Any time you want to log in through that browser it can talk to your phone and auth you automatically. For someone to exploit this, they'd need access to the computer with your browser. So if your laptop gets stolen, yes this is a bad idea, but I think most people think that they can just revoke the browser's keys if if the lapto…
Earlier quoted context omitted.
Side thought- what an interesting change from the software world 10 years ago. Who would have thought windows support was a lower priority then OS X and Linux. Onward and upward!
In this particular case it's all about Windows not having a decent SSH client. There's PuTTY... and uh... PuTTY. Oh, and you can sort of maybe run OpenSSH through LSFW or Cygwin, or maybe msys, but those all have some serious gotchas associated with them. Basically it boils down to, there's no standard Windows SSH client, and the ones that are available all have a laundry list of gotchas and problems, and that's with…
https://www.howtogeek.com/336775/how-to-enable-and-use-windo...
Can anyone comment on their "zero touch is safe" claim ( https://krypt.co/faq/ )? As far as I understand, tokens like YubiKeys require a touch as an explicit action by the user to prevent authentication without their knowledge. Doesn't a zero touch approach remove a security feature?
Has this been audited? It sure seems like a wonderful/convenient alternative to hardware keys, but something makes me nervous about the phone aspect. I'd love to read more comments here from those more knowledgeable than I.
It doesn't seem this can really be FIDO, because FIDO only defines usb, nfc, and ble security keys. I'm not saying Krypton is bad, just that you're installing an extension that (I imagine) interacts with a server to send a push to your phone. It's a very different security model than keys, that require no extension and don't interact with any 3rd party. Update: I'm seeing that my comment is read as negative, and I do…
but does it work for browsing on the phone itself? if so, slam dunk. even without that, it is what U2F was always destined to become. it's especially better than u2fzero. ;)
> it's especially better than u2fzero. ;) genuinely curious: why? (disclaimer: I'm working on Solo, the successor of u2fzero)
What if I lose my phone?
Many websites require a backup two-factor authentication methods such as SMS and TOTP (authenticator 6 digit-code apps) even if you are using a U2F security key such as Krypton. For certain sites that allow U2F only (such as Google Advanced Protection), we recommend having a backup phone with separate Krypton U2F key setup or a physical hardware key that you store securely in somewhere.
We are actively building a robust account recovery service with partners to solve this problem and make U2F/WebAuthn a viable "single-factor" login system. We hope this will remove the need for these backup methods that make your account vulnerable to phishing attacks. We also see this as a major barrier to wide adoption of U2F/WebAuth/2FA so we are eager to solve this problem.
What happens when you upgrade or, God forbid, lose your phone? Do I need to redo everything from scratch like I have to do with my Krypton PGP and SSH keys? That's a no go for me. I'm pretty happy with 1Password already!
I would hope so. Anything less is not secure. (This is one of the basic "problems" with hardware authentication.)
However, the software model allows for pre-arranged cloud sync between multiple devices. Given how Krypton handles PGP/SSH this support isn't there, but there's no technical obstacle.