Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Krypton: phone-based U2F Authenticator

krypt.co

Post reply on HN
Print view View original

91–100 of 100 posts

Re: Krypton: phone-based U2F Authenticator

#91

Post by jiveturkey »

Dylan16807 wrote: post #78
jiveturkey wrote: post #30

Earlier quoted context omitted.

> Do I need to redo everything from scratch I would hope so. Anything less is not secure. (This is one of the basic "problems" with hardware authentication.) However, the software model allows for pre-arranged cloud sync between multiple devices. Given how Krypton handles PGP/SSH this support isn't there, but there's no technical obstacle.

How are you defining "hardware" here? Plenty of HSMs can export secrets. It's straightforward to have them make a regular export, encrypted such that only the backup HSM can read them. Edit: You simultaneously made a comment saying almost exactly the same thing, so now I really don't understand why you would say anything less than "redo from scratch" is insecure. Is there an unstated assumption of "if you have no oth…

yes i was speaking from a simplistic/narrow POV, not a complete and i guess not a correct answer.

Re: Krypton: phone-based U2F Authenticator

#92

Post by jiveturkey »

dijit wrote: post #55
maherbeg wrote: post #49

How does the browser communicate with the phone? Does it require an intermediary server that krypt.co runs?

Yeah, it's using Amazon SQS. It's listed in their docs.

oy. I'd assumed there was a browser-side USB->BLE plugin.

This is horrible. Now the security of it is tied to the security of the stuff they have running in Amazon. Which they probably don't publish source code for? Even if they do, you have no way to know that is what is actually running.

Not the mention reliability and availability concerns.

ah well, I had such high hopes.

Re: Krypton: phone-based U2F Authenticator

#93

Post by lostmsu »

dabeeeenster wrote: post #38
dabeeeenster wrote: post #37

Can someone explain how this works!? I have looked all over the Krypt website but I still don't get it?!

OK finally found it in the FAQ for those that are slow like me: Is "zero touch" secure? How is it a second factor if it approves automatically? Yes, zero touch is safe. The security behind Krypton is established when you pair Krypton with your browser (via the extension) by scanning the QR code. This ensures that only your specific browser will be able to talk to Krypton. Krypton and your browser establish a secure c…

If they steal password from your browser by, say, installing keylogger, that same keylogger can now also steal the computer side Krypton key. So zero touch does not help against that class of attacks, while normal U2F would.

Re: Krypton: phone-based U2F Authenticator

#94

Post by type0 »

thrillgore wrote: post #53
CiPHPerCoder wrote: post #7

Earlier quoted context omitted.

https://github.com/kryptco/krypton-android/blob/e5e1399caea4... You weren't kidding. :(

Someone paid attention to what Redislabs did, and wanted to get ahead of it. In the most ass way possible.

Both are source available software [0], other than that you can't compare them. Krypton is fully proprietary nothing more nothing less, what RedisLabs did was a complete disservice to the whole open source phenomena without addressing any actual business concerns. They misinterpreted the whole clause thing to somehow say that your software can be both open and closed at the same time (it can't). They could at least had maybe done a minimal research and maybe learned somethings from Suns community source SCSL [1] or other similar liceses from the past and they even didn't bother doing that (the irony that SCSL is now hosted at Oracle speaks for itself).

[0] https://en.wikipedia.org/wiki/Source-available_software [1] https://www.oracle.com/technetwork/java/scsl-1-1-149938.txt

Re: Krypton: phone-based U2F Authenticator

#95

Post by desdiv »

solatic wrote: post #88
jgalt212 wrote: post #41

Earlier quoted context omitted.

or you can compile it yourself, or am missing something from you comment?

If all rights are reserved on the original source code, then compiling the source code can be construed as intent for intellectual property theft, since the right to compile the code was never expressly given to you. Looking at all-rights-reserved code on a public repository on GitHub is like going to a strip club - you may look, but you can't touch.

Then it's a good thing that they made clarifications in their FAQ:

>Feel free to compile Krypton from source and run it on your phone and workstation. [0]

[0] https://krypt.co/faq/

Re: Krypton: phone-based U2F Authenticator

#96

Post by l2dy »

pebers wrote: post #64
jwfxpr wrote: post #62

Earlier quoted context omitted.

> I've not tried it, but they also suggest you can compile your own binaries from that source to get around the untrusted binary problem. You could ... Except that, if I'm not mistaken, "All Rights Reserved" doesn't allow you to compile and use the code in any way, including diffing. IINAL, is that an incorrect reading?

IANAL either but I agree, that is a statement of copyright which is not unusual, but there is no licence and therefore we have no right to copy & use it.

> If you set your pages and repositories to be viewed publicly, you grant each User of GitHub a nonexclusive, worldwide license to use, display, and perform Your Content through the GitHub Service and to reproduce Your Content solely on GitHub as permitted through GitHub's functionality (for example, through forking).

We are granted a license to use it on GitHub by the GitHub ToS.

https://help.github.com/articles/github-terms-of-service/#5-...

Re: Krypton: phone-based U2F Authenticator

#97

Post by jiveturkey »

jiveturkey wrote: post #92
dijit wrote: post #55

Earlier quoted context omitted.

Yeah, it's using Amazon SQS. It's listed in their docs.

oy. I'd assumed there was a browser-side USB->BLE plugin. This is horrible. Now the security of it is tied to the security of the stuff they have running in Amazon. Which they probably don't publish source code for? Even if they do, you have no way to know that is what is actually running. Not the mention reliability and availability concerns. ah well, I had such high hopes.

After investigation, I have to retract my complaint. The browser-side agent is paired with your phone, Apple style. It's not a Google-style arrangement where you pair with Google and Google pairs with you, ie Google is in the middle.

So as long as the source code for both parts (browser-side and phone-side) is there, and you can audit that the code viewable is the code installed, this is pretty solid.

Of course the reliability and availability issue is still there.

Re: Krypton: phone-based U2F Authenticator

#98

Post by shara_dun »

I just discover a lot of people are in debts and also under credit issues crisis, I was also among them before i met this great guy that change my life for good. I have about 5 accounts and i have debts in all. I also have 2 chase credit cards and 1 Amex that are maxed out already. My credit score is about 520 as at then. He helped me clear the debts on my 5 accounts within a week, He also got the debts on the credit cards done within a week as well. He helped me increase my credit score 850 excellent within 72 hours. All my accounts are free from debts and i can now use my credit cards peacefully as well. All thanks to the computer guru. You are worth publicizing for. (NASH89440 @ G MAIL. COM or +1(309)884-0215.

Re: Krypton: phone-based U2F Authenticator

#99

Post by shara_dun »

I just discover a lot of people are in debts and also under credit issues crisis, I was also among them before i met this great guy that change my life for good. I have about 5 accounts and i have debts in all. I also have 2 chase credit cards and 1 Amex that are maxed out already. My credit score is about 520 as at then. He helped me clear the debts on my 5 accounts within a week, He also got the debts on the credit cards done within a week as well. He helped me increase my credit score 850 excellent within 72 hours. All my accounts are free from debts and i can now use my credit cards peacefully as well. All thanks to the computer guru. You are worth publicizing for. (NASH89440 @ G MAIL. COM or +1(309)884-0215.

Re: Krypton: phone-based U2F Authenticator

#100

Post by aespinoza »

jiveturkey wrote: post #31
aespinoza wrote: post #22

So what is the difference between Krypton and Duo? Why are they so innovative? By reading the website it seems they are doing the same thing as Duo.

they are hugely different. Duo is a full SSO and 2FA solution. Krypton supplies a few pieces at the edge.

Interesting. I will check it out further. Thank you.
Post reply on HN