31–40 of 100 posts
So what is the difference between Krypton and Duo? Why are they so innovative? By reading the website it seems they are doing the same thing as Duo.
This is going to change everything for me. You sirs, have cracked the hard problem: how do we make U2F easy enough for users to use without taking away the "something you have" aspect of it. This is brilliant. I love it! Now please fix the licensing, make the core open-source, be a bit more transparent, and get audited. It would really inspire a lot more confidence in a tool whose target audience is currently the sec…
That's completely unfair. U2F was from the start designed to be rendered in this kind of form factor. "All" Krypton (and Duo, BTW) did was implement this obvious form factor.
U2F itself, was the hard problem.
And anyway, push 2FA has been around for approx. as long as U2F. It may not be obvious now, but U2F will ultimately die in favor of push. IMHO. (they each have strengths and weaknesses but overall push is better.)
Has this been audited? It sure seems like a wonderful/convenient alternative to hardware keys, but something makes me nervous about the phone aspect. I'd love to read more comments here from those more knowledgeable than I.
It doesn't seem this can really be FIDO, because FIDO only defines usb, nfc, and ble security keys. I'm not saying Krypton is bad, just that you're installing an extension that (I imagine) interacts with a server to send a push to your phone. It's a very different security model than keys, that require no extension and don't interact with any 3rd party. Update: I'm seeing that my comment is read as negative, and I do…
Has this been audited? It sure seems like a wonderful/convenient alternative to hardware keys, but something makes me nervous about the phone aspect. I'd love to read more comments here from those more knowledgeable than I.
It doesn't seem this can really be FIDO, because FIDO only defines usb, nfc, and ble security keys. I'm not saying Krypton is bad, just that you're installing an extension that (I imagine) interacts with a server to send a push to your phone. It's a very different security model than keys, that require no extension and don't interact with any 3rd party. Update: I'm seeing that my comment is read as negative, and I do…
From the FAQ:
"The Krypton browser extension currently only works on Google Chrome and Firefox.
Safari, and Edge are coming soon."
Also, it supports U2F. From the FAQ:
"Krypton supports any site that supports U2F security keys."
U2F is one of the two protocols supported by the FIDO standard (the other one is UAF). This doesn't say anything about whether this uses FIDO (v1) or FIDO2 though.
I think this is pretty cool from a user friendly PoV. Google Android has something similar. The Facebook app doesn't AFAIK (I quit Facebook so cannot verify), but Battle.net does and so does Microsoft Authenticator. The disadvantage is that you need all these separate apps. I'd rather use just one.
Can someone explain how this works!? I have looked all over the Krypt website but I still don't get it?!
Is "zero touch" secure? How is it a second factor if it approves automatically? Yes, zero touch is safe. The security behind Krypton is established when you pair Krypton with your browser (via the extension) by scanning the QR code. This ensures that only your specific browser will be able to talk to Krypton. Krypton and your browser establish a secure cryptographic channel using keys that only your phone and computer have. There is NO trusted third-party.
Two-factor is simply a way to defend against compromised passwords. If someone knows your password and attempts to login then they'll be hit with a second-factor challenge. Since this attacker is remote and doesn't have access to your browser they won't be able to talk to Krypton.
This is going to change everything for me. You sirs, have cracked the hard problem: how do we make U2F easy enough for users to use without taking away the "something you have" aspect of it. This is brilliant. I love it! Now please fix the licensing, make the core open-source, be a bit more transparent, and get audited. It would really inspire a lot more confidence in a tool whose target audience is currently the sec…
> You sirs, have cracked the hard problem That's completely unfair. U2F was from the start designed to be rendered in this kind of form factor. "All" Krypton (and Duo, BTW) did was implement this obvious form factor. U2F itself, was the hard problem. And anyway, push 2FA has been around for approx. as long as U2F. It may not be obvious now, but U2F will ultimately die in favor of push. IMHO. (they each have strengths…
What happens when you upgrade or, God forbid, lose your phone? Do I need to redo everything from scratch like I have to do with my Krypton PGP and SSH keys? That's a no go for me. I'm pretty happy with 1Password already!
> Do I need to redo everything from scratch I would hope so. Anything less is not secure. (This is one of the basic "problems" with hardware authentication.) However, the software model allows for pre-arranged cloud sync between multiple devices. Given how Krypton handles PGP/SSH this support isn't there, but there's no technical obstacle.