What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…
On their FAQ page they state that their app is 'public source'. I assume that is so you (or presumably your organization) can audit (rather than debug) it if necessary. I've not tried it, but they also suggest you can compile your own binaries from that source to get around the untrusted binary problem.
Krypton: phone-based U2F Authenticator
61–70 of 100 posts
Re: Krypton: phone-based U2F Authenticator
#62What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…
On their FAQ page they state that their app is 'public source'. I assume that is so you (or presumably your organization) can audit (rather than debug) it if necessary. I've not tried it, but they also suggest you can compile your own binaries from that source to get around the untrusted binary problem.
> I've not tried it, but they also suggest you can compile your own binaries from that source to get around the untrusted binary problem.
You could... Except that, if I'm not mistaken, "All Rights Reserved" doesn't allow you to compile and use the code in any way, including diffing.
IINAL, is that an incorrect reading?
Re: Krypton: phone-based U2F Authenticator
#63How does the browser communicate with the phone? Does it require an intermediary server that krypt.co runs?
Yeah, it's using Amazon SQS. It's listed in their docs.
Ah, yeah I see it now. It wasn't listed in the FAQ which would be useful.
That's a slight bummer because now there's another service dependency in your authentication flow. It's probably pretty rare that SQS will go down, but still is a bummer.
Re: Krypton: phone-based U2F Authenticator
#64Earlier quoted context omitted.
On their FAQ page they state that their app is 'public source'. I assume that is so you (or presumably your organization) can audit (rather than debug) it if necessary. I've not tried it, but they also suggest you can compile your own binaries from that source to get around the untrusted binary problem.
> I've not tried it, but they also suggest you can compile your own binaries from that source to get around the untrusted binary problem. You could ... Except that, if I'm not mistaken, "All Rights Reserved" doesn't allow you to compile and use the code in any way, including diffing. IINAL, is that an incorrect reading?
IANAL either but I agree, that is a statement of copyright which is not unusual, but there is no licence and therefore we have no right to copy & use it.
Re: Krypton: phone-based U2F Authenticator
#65What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…
This is the business model. https://krypt.co/devops/pricing/
Correct – their business model is around providing 2FA security for your entire organization.
Re: Krypton: phone-based U2F Authenticator
#66Earlier quoted context omitted.
I haven't researched their claim, but my guess is that with something like yubikey you wouldn't know an authentication has happened. with Krypton, there would be a notification pending on your phone. Possibly you would only be able to authenticate if your phone is unlocked as well.
My phone locks after a while of inactivity. if I have to unlock the phone, then it wouldn't be zero touch, right?
When Krypton asks you to authorize an access, you can tell it to authorize that single access, authorize the host for three hours, or authorize everything for three hours.
I typically authorize the host for three hours, meaning for the next three hours I don't have to Touch ID in again.
Re: Krypton: phone-based U2F Authenticator
#67What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…
> With no way to validate that the source code on Github is what ends up in their compiled binaries, I don't see the value to anyone. you can say the same about all the other open source projects that don't have reproduceable builds.
[deleted]
Re: Krypton: phone-based U2F Authenticator
#68Earlier quoted context omitted.
This is the business model. https://krypt.co/devops/pricing/
Correct – their business model is around providing 2FA security for your entire organization.
who are the end users? organizations that outsources this type of security because it's too difficult to do with existing open source and cloud solutions? What sort of liability insurance do you guys have against data breaches and catastrophic failure?
Re: Krypton: phone-based U2F Authenticator
#69Earlier quoted context omitted.
Correct – their business model is around providing 2FA security for your entire organization.
who are the end users? organizations that outsources this type of security because it's too difficult to do with existing open source and cloud solutions? What sort of liability insurance do you guys have against data breaches and catastrophic failure?
What sort of open source and cloud solutions give you enterprise 2FA control for tools like GitHub that use SSH authentication?
Re: Krypton: phone-based U2F Authenticator
#70What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…
> With no way to validate that the source code on Github is what ends up in their compiled binaries, I don't see the value to anyone. you can say the same about all the other open source projects that don't have reproduceable builds.
and, in addition, anything you run from the App Store: