71–80 of 100 posts
Earlier quoted context omitted.
https://github.com/kryptco/krypton-android/blob/e5e1399caea4... You weren't kidding. :(
Someone paid attention to what Redislabs did, and wanted to get ahead of it. In the most ass way possible.
"Free as in beer, not as in speech."
You're welcome to pick your own license / source availability terms for your own work.
Ah yes, I remember seeing this before! This is interesting, because at work pretty much all of our logins (including for third-party services) go through SAML, where our IdPs use Duo for two-step. That gives us similar functionality to this, without needing to use a browser plugin. You do need to use an app, though, to avoid insecure SMS or voice. (Duo does support U2F, but it's not as obvious, because end users have…
Would be the perfect move for LastPass - around the beginning of this year Lastpass started a beta program for LastPass connect [0], however, was suddenly put on hold [1][2], and I think krypt's technology would be the perfect candidate to pull together the app.
I also trust LogMeIn much more than I trust Krypt to not push out malicious binaries, so there's a plus for that.
1: https://judge.sh/VBRJP4n.png
2: https://www.androidauthority.com/lastpass-connect-861342/
Earlier quoted context omitted.
> You sirs, have cracked the hard problem That's completely unfair. U2F was from the start designed to be rendered in this kind of form factor. "All" Krypton (and Duo, BTW) did was implement this obvious form factor. U2F itself, was the hard problem. And anyway, push 2FA has been around for approx. as long as U2F. It may not be obvious now, but U2F will ultimately die in favor of push. IMHO. (they each have strengths…
Push = some company owns your 2FA credential, right? Or were you talking about something else?
What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…
I understand that's a lot of "ifs", but even if it was fully open source, it's hard to use it in anyway that's scale-able, since hardly anyone wants to compile it themselves, and hardly anyone can get it on to their phone by themselves in some ecosystems
It sure would be nice to have some process to ensure my phone was running what I thought it was, even if it required publisher opt-in (and even if it requires I trust the phone OS).
Earlier quoted context omitted.
> Do I need to redo everything from scratch I would hope so. Anything less is not secure. (This is one of the basic "problems" with hardware authentication.) However, the software model allows for pre-arranged cloud sync between multiple devices. Given how Krypton handles PGP/SSH this support isn't there, but there's no technical obstacle.
I think you don't get security. When you make something so hard for people to do, they just won't do it. It's like every website having a different password strength policy, people start reusing the same passwords or use 1Password. I upgrade my phone every year. I won't go thru a billion websites on which I enabled 2FA to swap the device. Also, when you upgrade phones at stores, you don't have both devices together f…
I charge $500/hr for security consulting, 1 week minimums, and am fully booked for months out. I have 20 years in security experience. I'd say I "get it".
I specialize in security UX.
Don't mistake my absolute position on what is secure vs what is usable and what will be used. In general I am a critic of U2F.
All the problems you have stated are real, and you are correct, however the way to overcome them is NOT to have the device keep/use the secret "insecurely". Watch Apple's blackhat talk from last year for some insight into the problem and a usability-friendly yet still secure approach.
It's a hard problem, not one that is going to be solved here on HN discussion.
Earlier quoted context omitted.
> Do I need to redo everything from scratch I would hope so. Anything less is not secure. (This is one of the basic "problems" with hardware authentication.) However, the software model allows for pre-arranged cloud sync between multiple devices. Given how Krypton handles PGP/SSH this support isn't there, but there's no technical obstacle.
Is there no way to provide some paper backup for U2F at least?
You just need a device that you tell it some master key, or that can export it for you. eg a true ($$$$$) HSM can do this, exporting keys that can [only] be imported to another device configured for the same security "world".
Earlier quoted context omitted.
> Do I need to redo everything from scratch I would hope so. Anything less is not secure. (This is one of the basic "problems" with hardware authentication.) However, the software model allows for pre-arranged cloud sync between multiple devices. Given how Krypton handles PGP/SSH this support isn't there, but there's no technical obstacle.
I think you don't get security. When you make something so hard for people to do, they just won't do it. It's like every website having a different password strength policy, people start reusing the same passwords or use 1Password. I upgrade my phone every year. I won't go thru a billion websites on which I enabled 2FA to swap the device. Also, when you upgrade phones at stores, you don't have both devices together f…
Security is literally spending resources to protect something. Time is a resource. Space in your brain is a resource.
If I want to secure a city, I spend labor and materials to build a wall. If I want to secure my documents, I spend money on a safe. If I want to secure my emails, I spend brain space and time dealing with passwords.
You can argue that the resource security tradeoff is too expensive and that being insecure is a better choice, but just because something is harder doesn't mean it's less secure. People make that choice every day. When someone reuses a password, they are choosing to not use brain space and instead be less secure.
What happens when you upgrade or, God forbid, lose your phone? Do I need to redo everything from scratch like I have to do with my Krypton PGP and SSH keys? That's a no go for me. I'm pretty happy with 1Password already!
> Do I need to redo everything from scratch I would hope so. Anything less is not secure. (This is one of the basic "problems" with hardware authentication.) However, the software model allows for pre-arranged cloud sync between multiple devices. Given how Krypton handles PGP/SSH this support isn't there, but there's no technical obstacle.
Plenty of HSMs can export secrets. It's straightforward to have them make a regular export, encrypted such that only the backup HSM can read them.
Edit: You simultaneously made a comment saying almost exactly the same thing, so now I really don't understand why you would say anything less than "redo from scratch" is insecure. Is there an unstated assumption of "if you have no other device"? Because that was not clear at all.
What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…
Earlier quoted context omitted.
I think you don't get security. When you make something so hard for people to do, they just won't do it. It's like every website having a different password strength policy, people start reusing the same passwords or use 1Password. I upgrade my phone every year. I won't go thru a billion websites on which I enabled 2FA to swap the device. Also, when you upgrade phones at stores, you don't have both devices together f…
I think you don't get security. Security is literally spending resources to protect something. Time is a resource. Space in your brain is a resource. If I want to secure a city, I spend labor and materials to build a wall. If I want to secure my documents, I spend money on a safe. If I want to secure my emails, I spend brain space and time dealing with passwords. You can argue that the resource security tradeoff is t…
