Krypton: phone-based U2F Authenticator • Hacker News Board

Re: Krypton: phone-based U2F Authenticator

#51

Post by nikolay » Thu, Aug 30, 2018, 7:41 PM UTC

jiveturkey wrote: post #30

nikolay wrote: post #26

What happens when you upgrade or, God forbid, lose your phone? Do I need to redo everything from scratch like I have to do with my Krypton PGP and SSH keys? That's a no go for me. I'm pretty happy with 1Password already!

> Do I need to redo everything from scratch I would hope so. Anything less is not secure. (This is one of the basic "problems" with hardware authentication.) However, the software model allows for pre-arranged cloud sync between multiple devices. Given how Krypton handles PGP/SSH this support isn't there, but there's no technical obstacle.

I think you don't get security. When you make something so hard for people to do, they just won't do it. It's like every website having a different password strength policy, people start reusing the same passwords or use 1Password. I upgrade my phone every year. I won't go thru a billion websites on which I enabled 2FA to swap the device. Also, when you upgrade phones at stores, you don't have both devices together for an unlimited time. If you want better security, then 3FA > 2FA, i.e. two things you have, and one thing you know.

Re: Krypton: phone-based U2F Authenticator

#52

Post by nikolay » Thu, Aug 30, 2018, 7:43 PM UTC

0xCMP wrote: post #48

mtgx wrote: post #40

Earlier quoted context omitted.

Is there no way to provide some paper backup for U2F at least?

Best bet is the service providing those kinds of codes for recovery. Twitter, Google, etc. provide them when you sign up for OTP and U2F.

So, all this fancy security boils down to a notepad again. I am an early adopter of Krypton and I've been sorry so many times that I'm using it for SSH and PGP.

Re: Krypton: phone-based U2F Authenticator

#53

Post by thrillgore » Thu, Aug 30, 2018, 7:49 PM UTC

CiPHPerCoder wrote: post #7

jrockway wrote: post #5

What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…

https://github.com/kryptco/krypton-android/blob/e5e1399caea4... You weren't kidding. :(

Someone paid attention to what Redislabs did, and wanted to get ahead of it. In the most ass way possible.

Re: Krypton: phone-based U2F Authenticator

#54

Post by dsr_ » Thu, Aug 30, 2018, 8:06 PM UTC

mattpavelle wrote: post #50

jgalt212 wrote: post #41

Earlier quoted context omitted.

or you can compile it yourself, or am missing something from you comment?

Right. You could also compile it yourself with the same chainset / toolset the Krypton folks use and compare the binaries. There's probably a way to compare everything but the digital signature with two binaries too... Not sure

The overall concept is "reproducible builds". Without it, you have the Reflections on Trusting Trust problem.

Re: Krypton: phone-based U2F Authenticator

#55

Post by dijit » Thu, Aug 30, 2018, 8:30 PM UTC

maherbeg wrote: post #49

How does the browser communicate with the phone? Does it require an intermediary server that krypt.co runs?

Yeah, it's using Amazon SQS.

It's listed in their docs.

Re: Krypton: phone-based U2F Authenticator

#56

Post by dijit » Thu, Aug 30, 2018, 8:31 PM UTC

jmuguy wrote: post #34

I've been using Krypton for SSH for a while (basically the private key is on the phone and you approve logins using the app, they must have just added U2F recently). Its worked really well and is super simple to setup when logging into a new server.

It's also really nice for signing git commits. I like it a lot.

(although I can't access the section of the app on an iPhone 5SE)

Re: Krypton: phone-based U2F Authenticator

#57

Post by ithkuil » Thu, Aug 30, 2018, 8:32 PM UTC

jiveturkey wrote: post #25

jonafato wrote: post #16

Can anyone comment on their "zero touch is safe" claim ( https://krypt.co/faq/ )? As far as I understand, tokens like YubiKeys require a touch as an explicit action by the user to prevent authentication without their knowledge. Doesn't a zero touch approach remove a security feature?

I haven't researched their claim, but my guess is that with something like yubikey you wouldn't know an authentication has happened. with Krypton, there would be a notification pending on your phone. Possibly you would only be able to authenticate if your phone is unlocked as well.

My phone locks after a while of inactivity. if I have to unlock the phone, then it wouldn't be zero touch, right?

Re: Krypton: phone-based U2F Authenticator

#58

Post by 0xCMP » Thu, Aug 30, 2018, 8:32 PM UTC

nikolay wrote: post #52

0xCMP wrote: post #48

Earlier quoted context omitted.

Best bet is the service providing those kinds of codes for recovery. Twitter, Google, etc. provide them when you sign up for OTP and U2F.

So, all this fancy security boils down to a notepad again. I am an early adopter of Krypton and I've been sorry so many times that I'm using it for SSH and PGP.

I use for SSH, but yea I agree it could be better. I just got a Yubikey which I plan to replace Krypton daily and have it as a backup

Re: Krypton: phone-based U2F Authenticator

#59

Post by gruez » Thu, Aug 30, 2018, 8:36 PM UTC

jrockway wrote: post #5

What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…

> With no way to validate that the source code on Github is what ends up in their compiled binaries, I don't see the value to anyone.

you can say the same about all the other open source projects that don't have reproduceable builds.

Re: Krypton: phone-based U2F Authenticator

#60

Post by oedmarap » Thu, Aug 30, 2018, 8:39 PM UTC

Just one gripe: I absolutely do not think it's a good idea to have zero-touch ON by default.

I understand their argument about security vs. usability for laypeople as it's an age old one, but I think that applies better to situations where there's a marked tradeoff in principle.

Tapping just once or reaching for one's phone doesn't detract from usability. Quite the contrary, it's a common sense approach (and teaches common sense security posture) to give one's explicit agreement for authentication, U2F or otherwise.

Otherwise, the intended user base that zero-touch seems to target may end up being the same folks that question why it didn't work out of the box to protect their logins when their laptop gets physically compromised; since they assumed they didn't have to "understand or care about the differences between two-factor, U2F, or web authentication" in the first place, to quote the FAQ.