41–50 of 100 posts
Earlier quoted context omitted.
If anything, a commercial security product that allows anyone to audit the source code seems like a pretty Useful Pattern
...only if you can prove that the source code you show them builds the binary that you install, every single time.
Earlier quoted context omitted.
> it's especially better than u2fzero. ;) genuinely curious: why? (disclaimer: I'm working on Solo, the successor of u2fzero)
look at my numerous comments in the 2 HN threads on solo/u2fzero.
Again, I'm not trying to downplay Krypton, I like the phone solution a lot, I think it's much more usable than security keys. I use push notifications all the times e.g. via DUO. But I still think we need physical security keys against online attacks, for example as a mechanism to secure your phone itself.
Has this been audited? It sure seems like a wonderful/convenient alternative to hardware keys, but something makes me nervous about the phone aspect. I'd love to read more comments here from those more knowledgeable than I.
It doesn't seem this can really be FIDO, because FIDO only defines usb, nfc, and ble security keys. I'm not saying Krypton is bad, just that you're installing an extension that (I imagine) interacts with a server to send a push to your phone. It's a very different security model than keys, that require no extension and don't interact with any 3rd party. Update: I'm seeing that my comment is read as negative, and I do…
And phones makers are starting to adopt "hardware security modules" (just Pixel 2 so far, not sure about the new Samsung ones) and Android 9 is giving app developers access to them via API.
So I guess in theory one could turn the phone into an actual "U2F security key," for all intents and purposes?
What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…
but does it work for browsing on the phone itself? if so, slam dunk. even without that, it is what U2F was always destined to become. it's especially better than u2fzero. ;)
Hopefully other sites support iOS based callbacks soon.
We haven't audited this personally but I'm lsoking forward to doing so. This looks awesome -- my only problem is that it doesn't solve U2F/WebAuthn on the phone itself, which is still a lot more complicated on iOS than it is on Android (even though overall, I think iOS is a better platform than Android, at least from a security perspective).
On iOS it works for Google logins, see the blog post here: https://krypt.co/blog/posts/use-google-advanced-protection-w....
Earlier quoted context omitted.
> Do I need to redo everything from scratch I would hope so. Anything less is not secure. (This is one of the basic "problems" with hardware authentication.) However, the software model allows for pre-arranged cloud sync between multiple devices. Given how Krypton handles PGP/SSH this support isn't there, but there's no technical obstacle.
Is there no way to provide some paper backup for U2F at least?
Earlier quoted context omitted.
...only if you can prove that the source code you show them builds the binary that you install, every single time.
or you can compile it yourself, or am missing something from you comment?