Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 98 posts

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#31

Post by tialaramex »

thekeyper wrote: post #23
tialaramex wrote: post #13

For the smartphone case, why would I want to pay for Keyri, rather than use WebAuthn (for the web) or the smartphone OS-provided FIDO2 feature that ships with the OS? https://developers.google.com/identity/fido/android/native-a...

Keyri makes less sense for smartphone-only applications. The primary case we solve for is applications that have both mobile and desktop web interfaces. Phones are already essentially considered trusted devices, whether auth there happened via password, SMS OTP, OpenID, FIDO2, etc. Keyri bridges the "trust gap" between the trusted smartphone in the user's hand and the untrusted desktop computer / smart TV / whatever…

For the desktop scenario, the reason that "trust gap" exists is that the chain of custody is too murky and if Keyri solves that I didn't see how. Of course maybe that's your secret sauce.

Specifically, how does the phone know which web page its owner is looking at on their laptop when they scanned the QR code ? You need to arrange that it's not possible to take the QR code generated for you and present it to a sucker for them to scan instead so that you're signed in as them and like I said, if Keyri does that then I don't see how.

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#33

Post by thekeyper »

tialaramex wrote: post #31
thekeyper wrote: post #23

Earlier quoted context omitted.

Keyri makes less sense for smartphone-only applications. The primary case we solve for is applications that have both mobile and desktop web interfaces. Phones are already essentially considered trusted devices, whether auth there happened via password, SMS OTP, OpenID, FIDO2, etc. Keyri bridges the "trust gap" between the trusted smartphone in the user's hand and the untrusted desktop computer / smart TV / whatever…

For the desktop scenario, the reason that "trust gap" exists is that the chain of custody is too murky and if Keyri solves that I didn't see how. Of course maybe that's your secret sauce. Specifically, how does the phone know which web page its owner is looking at on their laptop when they scanned the QR code ? You need to arrange that it's not possible to take the QR code generated for you and present it to a sucker…

Nail on the head. That's the problem that the secret sauce solves. Without going too much in to it (because I don't think it's a very defensible moat at the moment), the phone sees stuff on the screen other than the QR code, which bad actors cannot present to victims.

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#34

Post by thekeyper »

sabrehagen wrote: post #29
thekeyper wrote: post #23

Earlier quoted context omitted.

Keyri makes less sense for smartphone-only applications. The primary case we solve for is applications that have both mobile and desktop web interfaces. Phones are already essentially considered trusted devices, whether auth there happened via password, SMS OTP, OpenID, FIDO2, etc. Keyri bridges the "trust gap" between the trusted smartphone in the user's hand and the untrusted desktop computer / smart TV / whatever…

You referred to 'QR + CV + HTTPS system'. Is there more to the CV component than taking a photo?

Yes, there's more to it than just reading the QR code. As mentioned above, I don't think it's a very defensible tech differentiator right now (lots of better-funded cybersecurity companies out there), but in summary, the phone sees stuff on the screen other than the QR code.

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#35

Post by necovek »

I was immediately intrigued by the proposal, though I can't imagine ever wanting to rely on my phone to be identified (what if my battery dies? I left it in another room? hey, a customer is gone and that sale has not gone through).

> They also allow users to share their subscription accounts with others, robbing companies of revenue.

This made me question your motives: "robbing" is a very strong statement for something like sharing accounts — even if you are in that extortionist camp that likes to get every last cent out of the customer, I wouldn't advertise it as widely.

Why do you feel that companies should be worried about people sharing accounts with people they have enough trust in to share accounts (and devices like your phone) with?

It's also the first time I read that OpenID requires somebody else to see your private keys, or to share any private data that you do not wish to share: can you elaborate on that?

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#36

Post by ignoramous »

thekeyper wrote: post #21
ignoramous wrote: post #7

Congratulations on the launch, Zain and Grant. I've come across a decent share of passwordless solutions in recent times (like gazepass.com and sawolabs.com to name two of the recent upstarts in the space), while GRC's SQRL has been around a lot longer. The bane of passwordless auth systems is the whole ceremony around forgot-password / change-password flows (in this case, re-associating a new public/private keypair,…

Thanks very much for the heavily referenced post. As an aside, I built the prototype of this last year in a vacuum without knowing any passwordless solutions other than FIDO2 systems. My cofounder disabused me of the notion that this was a totally novel concept. I'd never heard of gazepass or sawolabs before and now feel even less original :). That said, I think you recognize the differences between our system and th…

Thanks! Btw, is keyri short for key-ring? In my native tongue, Gujarati, it means "Ant".

All the best.

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#38

Post by gflacount »

ignoramous wrote: post #36
thekeyper wrote: post #21

Earlier quoted context omitted.

Thanks very much for the heavily referenced post. As an aside, I built the prototype of this last year in a vacuum without knowing any passwordless solutions other than FIDO2 systems. My cofounder disabused me of the notion that this was a totally novel concept. I'd never heard of gazepass or sawolabs before and now feel even less original :). That said, I think you recognize the differences between our system and th…

Thanks! Btw, is keyri short for key-ring? In my native tongue, Gujarati, it means " Ant ". All the best.

haha - you guessed it! Draft 0.1 was to be named Keyri while owning the .ng domain name to create Keyri.ng. We opted against the Nigerian domain but kept Keyri.

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#39

Post by gflacount »

smoldesu wrote: post #37

The pricing page is very offputting to me. The first is free, but scaling starts and ends with "contact us"? Not the sort of thing I'd invest in, if I was in the market for such a thing. That's just my take though.

That's a fair point and something we're definitely looking into. Ultimately, if you are interested in our SDK, we'll need to have an implementation conversation and can discuss pricing at that time, but it's definitely something we're considering updating. Thank you for the feedback.

Re: Launch HN: Keyri (YC S21) – Secure smartphone-based passwordless authentication

#40

Post by qzw »

thekeyper wrote: post #33
tialaramex wrote: post #31

Earlier quoted context omitted.

For the desktop scenario, the reason that "trust gap" exists is that the chain of custody is too murky and if Keyri solves that I didn't see how. Of course maybe that's your secret sauce. Specifically, how does the phone know which web page its owner is looking at on their laptop when they scanned the QR code ? You need to arrange that it's not possible to take the QR code generated for you and present it to a sucker…

Nail on the head. That's the problem that the secret sauce solves. Without going too much in to it (because I don't think it's a very defensible moat at the moment), the phone sees stuff on the screen other than the QR code, which bad actors cannot present to victims.

So are you saying that even if the bad actors found out how the secret sauce works, they would not be able to spoof a legit page? In other words, is the obscurity in the CV part purely for competitive reasons, or does it also serve a security purpose?
Post reply on HN