Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Krypton: phone-based U2F Authenticator

krypt.co

Post reply on HN
Print view View original

81–90 of 100 posts

Re: Krypton: phone-based U2F Authenticator

#81

Post by ReverseCold »

jonafato wrote: post #23
henryfjordan wrote: post #19

Earlier quoted context omitted.

It depends on your threat model. You pair your phone and browser and then they can talk. Any time you want to log in through that browser it can talk to your phone and auth you automatically. For someone to exploit this, they'd need access to the computer with your browser. So if your laptop gets stolen, yes this is a bad idea, but I think most people think that they can just revoke the browser's keys if if the lapto…

I was more thinking of malware / some otherwise rogue process. This seems like something that's worth having in the world of fake support remote desktop scams.

That's so easy to bypass.

1. Wait for user to sign in. 2. Intercept their sign in. 3. User: "Oh, it didn't work. I'll just try again." 4. User tries again and it works. Attacker is also logged in now.

Alternatively, at that point you could just inject JS into whatever website needed 2FA and do everything without the user noticing anything.

Re: Krypton: phone-based U2F Authenticator

#82

Post by shakna »

jwfxpr wrote: post #62
davefp wrote: post #17

Earlier quoted context omitted.

On their FAQ page they state that their app is 'public source'. I assume that is so you (or presumably your organization) can audit (rather than debug) it if necessary. I've not tried it, but they also suggest you can compile your own binaries from that source to get around the untrusted binary problem.

> I've not tried it, but they also suggest you can compile your own binaries from that source to get around the untrusted binary problem. You could ... Except that, if I'm not mistaken, "All Rights Reserved" doesn't allow you to compile and use the code in any way, including diffing. IINAL, is that an incorrect reading?

> Krypton is public source! You can find it here github.com/kryptco and compile from source [0]

They give permission to compile on the website. Otherwise you would be correct.

[0] https://krypt.co/faq/

Re: Krypton: phone-based U2F Authenticator

#83

Post by ztjio »

mplewis wrote: post #73
mtgx wrote: post #39

Earlier quoted context omitted.

Push = some company owns your 2FA credential, right? Or were you talking about something else?

I think push means when you sign in, the server pushes a notification to your phone(s), which can accept or reject the request.

It feels exactly the same to use krypton. You pop up the website that wants auth and your phone dings and you tap a button and there you go. Compared to say, Blizzard's authenticator for battle.net, it does the same thing. You try to log in, it pushes a message to your phone you get a ding tap a button and you go.

As far as UX goes it's identical to the user.

Re: Krypton: phone-based U2F Authenticator

#84

Post by ztjio »

henryfjordan wrote: post #19
jonafato wrote: post #16

Can anyone comment on their "zero touch is safe" claim ( https://krypt.co/faq/ )? As far as I understand, tokens like YubiKeys require a touch as an explicit action by the user to prevent authentication without their knowledge. Doesn't a zero touch approach remove a security feature?

It depends on your threat model. You pair your phone and browser and then they can talk. Any time you want to log in through that browser it can talk to your phone and auth you automatically. For someone to exploit this, they'd need access to the computer with your browser. So if your laptop gets stolen, yes this is a bad idea, but I think most people think that they can just revoke the browser's keys if if the lapto…

It wouldn't matter if they had their laptop stolen unless they also had their phone stolen. The keys are on the phone. Any new auth attempt would require the phone in proximity of the laptop. It connects via Bluetooth, not over the internet.

Re: Krypton: phone-based U2F Authenticator

#85

Post by jarfil »

gruez wrote: post #59
jrockway wrote: post #5

What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled…

> With no way to validate that the source code on Github is what ends up in their compiled binaries, I don't see the value to anyone. you can say the same about all the other open source projects that don't have reproduceable builds.

That's why 90% of Debian packages are reproducible.

Re: Krypton: phone-based U2F Authenticator

#86

Post by amingilani »

ztjio wrote: post #83
mplewis wrote: post #73

Earlier quoted context omitted.

I think push means when you sign in, the server pushes a notification to your phone(s), which can accept or reject the request.

It feels exactly the same to use krypton. You pop up the website that wants auth and your phone dings and you tap a button and there you go. Compared to say, Blizzard's authenticator for battle.net, it does the same thing. You try to log in, it pushes a message to your phone you get a ding tap a button and you go. As far as UX goes it's identical to the user.

But there in lies the difference. With Krypton, the company doesn't own your keys, you so. It's like Fiat vs Bitcoin.. only there's literally no difference in experience.

That's why Krypton is better. It works everywhere U2F (an open spec) is supported, while the proprietary company solution is supported where the company has partnered

Re: Krypton: phone-based U2F Authenticator

#87

Post by amingilani »

jiveturkey wrote: post #32
amingilani wrote: post #12

This is going to change everything for me. You sirs, have cracked the hard problem: how do we make U2F easy enough for users to use without taking away the "something you have" aspect of it. This is brilliant. I love it! Now please fix the licensing, make the core open-source, be a bit more transparent, and get audited. It would really inspire a lot more confidence in a tool whose target audience is currently the sec…

> You sirs, have cracked the hard problem That's completely unfair. U2F was from the start designed to be rendered in this kind of form factor. "All" Krypton (and Duo, BTW) did was implement this obvious form factor. U2F itself, was the hard problem. And anyway, push 2FA has been around for approx. as long as U2F. It may not be obvious now, but U2F will ultimately die in favor of push. IMHO. (they each have strengths…

Correct me if I'm wrong but I think you're confusing U2F (the open standard) with a second factor of authentication (the thing)

U2F has traditionally been distributed in the form of physical tokens. It's an open standard compared to Duo's.

(The rest is just copied off another comment I made down this thread)

But there in lies the difference. With Krypton, the company doesn't own your keys, you do. It's like Fiat vs Bitcoin.. only there's literally no difference in experience.

That's why Krypton is better. It works everywhere U2F (an open spec) is supported, while the proprietary company solution is supported where the company has partnered

Re: Krypton: phone-based U2F Authenticator

#88

Post by solatic »

jgalt212 wrote: post #41
dsr_ wrote: post #18

Earlier quoted context omitted.

...only if you can prove that the source code you show them builds the binary that you install, every single time.

or you can compile it yourself, or am missing something from you comment?

If all rights are reserved on the original source code, then compiling the source code can be construed as intent for intellectual property theft, since the right to compile the code was never expressly given to you.

Looking at all-rights-reserved code on a public repository on GitHub is like going to a strip club - you may look, but you can't touch.

Re: Krypton: phone-based U2F Authenticator

#90

Post by moviuro »

hasa wrote: post #89

I don't see much sense using U2F. If you just need a 2nd factor, then TOTP based solutions do it cheaper and easier. FIDO 2.0 is the way to go if FIDO is required.

TOTP requires:

1. sharing a secret (which is bad, and possibly already compromised by the time it reaches your device (phone))

2. permanent attention to the domain. Remember similarities between the cyrillic a and latin a? (phishing, etc.)

Post reply on HN