4 ms·

That doesn't seem especially more secure. You're just trading away trusting yourself to another company. You can get a similar ssh 2fa setup with Google Authen

That doesn't seem especially more secure. You're just trading away trusting yourself to another company. You can get a similar ssh 2fa setup with Google Authenticator's PAM module (https://github.com/google/google-authenticator-libpam https://github.com/google/google-authenticator-libpam), and maintain full control over your infrastructure.

pfg 9y ago
Kryptonite is more like a GPG smartcard (or YubiKey) of sorts (with some security trade-offs for the arguably better UX). The key never leaves your mobile device. Backdoors and bugs are still a possibility of course (when aren't they?), and you probably wouldn't wan to run this on an outdated mobile device. Of course, all you're doing with any of this is preventing your key from leaking. A sufficiently motivated attacker could just backdoor your ssh/git binary and access things through that instead, but it's still a good defense-in-depth mechanism, IMO.
- danjoc 9y ago
  >Kryptonite is more like a GPG smartcard (or YubiKey) Can it do full disk encryption? Works with GPG agent? PIV? PKCS11? OTP? U2F? >arguably better UX Requires battery. Not waterproof. Not crushproof. >The key never leaves your mobile device. Can't backup the key? I need to buy two iPhones to have a backup in case one is lost?
  - mynameisvlad 9y ago
    The parent comment literally said arguably, as in, can be argued and is based on personal choice. And, although I'm not the commenter, it doesn't read anywhere near it trying to imply Kryptonite is a replacement for Yubikey. They were replying to someone comparing it to the 2FA PAM module, and explaining it's more like a smartcard or Yubikey in that it stores the key, rather than add a second verification outside the key.
    - danjoc 9y ago
      I asked the questions because I'd like to know the answer. I'm not arguing passive aggressively. I looked at the source repo, and at a glance, it looks like the app stores the key pair on the iOS keychain. My guess is that means the key can be removed from the device if the user chooses to do so, or if the user give access to the keychain to another application. Perhaps I'm wrong about that. I keep hearing "The key never leaves the device" repeated, and I'd mainly like to know how that guarantee is made.
      - pfg 9y ago
        The app uses kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly[1]. Quoting the relevant iOS documentation[2]: > After the first unlock, the data remains accessible until the next restart. This is recommended for items that need to be accessed by background applications. Items with this attribute do not migrate to a new device. Thus, after restoring from a backup of a different device, these items will not be present. [1]: https://github.com/kryptco/kryptonite-ios/blob/42c71d6381def40e1322f3b951a395f2c6e65178/Kryptonite/KeyPair.swift#L35 https://github.com/kryptco/kryptonite-ios/blob/42c71d6381def... [2]: https://developer.apple.com/reference/security/ksecattraccessibleafterfirstunlockthisdeviceonly https://developer.apple.com/reference/security/ksecattracces...
  - pfg 9y ago
    > Can it do full disk encryption? Works with GPG agent? PIV? PKCS11? OTP? U2F? My understanding is that the only use-case is SSH right now, but that could change, I guess. > Requires battery. Not waterproof. Not crushproof. Those are all valid. OTOH, it doesn't require yet another device that can be forgotten or lost, it's far easier to set up (compared to YubiKeys or other smartcards), and it's free. > Can't backup the key? I need to buy two iPhones to have a backup in case one is lost? That's correct. They plan to add paper backups and syncing via QR, IIRC. A second (regular) key that's kept offline would do as well. (FWIW, I use YubiKeys for GPG/SSH/OTP/U2F as well, but I'd definitely recommend this to anyone looking for a cheaper or more usable alternative.)
    - danjoc 9y ago
      >it doesn't require yet another device that can be forgotten or lost iPhones can be lost too. >it's far easier to set up Yubikey can do U2F and OTP out of the package with no setup required. While it can be easier (I wrote a nice shell script for myself), I don't consider setting up a Yubikey for SSH hard for the type of person who uses SSH, https://developers.yubico.com/PIV/Guides/ https://developers.yubico.com/PIV/Guides/ It's literally copy/pasting a few lines out of Yubico's docs into a shell. >it's free So is the Yubikey software. >They plan to add paper backups and syncing via QR, IIRC. I would consider that a fatal flaw. Once the private key is on the device, it should not be easy to recover it from the device.
      - pfg 9y ago
        > iPhones can be lost too. emphasis on yet another. One more thing to keep track of. Not everyone likes to have their (door) keys hanging off their notebooks all day. > Yubikey can do U2F and OTP out of the package with no setup required. Yes, but we're talking about git/ssh here. > While it can be easier (I wrote a nice shell script for myself), I don't consider setting up a Yubikey for SSH hard for the type of person who uses SSH, That's not my experience, but it suppose it might depend on who you know/work with, or in what area you work. > So is the Yubikey software. I was talking about the free beer kind of free, but it's not accurate to say YubiKey is all free (libre) either, it depends on the product. There was quite a controversy a while back[1]. Personally, I'm fine with closed-source security products. Ideological reasons aside, I don't think making decisions based on whether the code is open source makes sense. > I would consider that a fatal flaw. Once the private key is on the device, it should not be easy to recover it from the device. I wouldn't say it's a fatal flaw. You rely on your phone's security to manage access to signing operations anyway, so if an attacker has access to the app, you're pretty much screwed either way. Again, there are trade-offs, but it's a step-up from keeping keys on-device. [1]: https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...

pfg 9y ago

Kryptonite is more like a GPG smartcard (or YubiKey) of sorts (with some security trade-offs for the arguably better UX). The key never leaves your mobile device. Backdoors and bugs are still a possibility of course (when aren't they?), and you probably wouldn't wan to run this on an outdated mobile device. Of course, all you're doing with any of this is preventing your key from leaking. A sufficiently motivated attacker could just backdoor your ssh/git binary and access things through that instead, but it's still a good defense-in-depth mechanism, IMO.

danjoc 9y ago
>Kryptonite is more like a GPG smartcard (or YubiKey) Can it do full disk encryption? Works with GPG agent? PIV? PKCS11? OTP? U2F? >arguably better UX Requires battery. Not waterproof. Not crushproof. >The key never leaves your mobile device. Can't backup the key? I need to buy two iPhones to have a backup in case one is lost?
- mynameisvlad 9y ago
  The parent comment literally said arguably, as in, can be argued and is based on personal choice. And, although I'm not the commenter, it doesn't read anywhere near it trying to imply Kryptonite is a replacement for Yubikey. They were replying to someone comparing it to the 2FA PAM module, and explaining it's more like a smartcard or Yubikey in that it stores the key, rather than add a second verification outside the key.
  - danjoc 9y ago
    I asked the questions because I'd like to know the answer. I'm not arguing passive aggressively. I looked at the source repo, and at a glance, it looks like the app stores the key pair on the iOS keychain. My guess is that means the key can be removed from the device if the user chooses to do so, or if the user give access to the keychain to another application. Perhaps I'm wrong about that. I keep hearing "The key never leaves the device" repeated, and I'd mainly like to know how that guarantee is made.
    - pfg 9y ago
      The app uses kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly[1]. Quoting the relevant iOS documentation[2]: > After the first unlock, the data remains accessible until the next restart. This is recommended for items that need to be accessed by background applications. Items with this attribute do not migrate to a new device. Thus, after restoring from a backup of a different device, these items will not be present. [1]: https://github.com/kryptco/kryptonite-ios/blob/42c71d6381def40e1322f3b951a395f2c6e65178/Kryptonite/KeyPair.swift#L35 https://github.com/kryptco/kryptonite-ios/blob/42c71d6381def... [2]: https://developer.apple.com/reference/security/ksecattraccessibleafterfirstunlockthisdeviceonly https://developer.apple.com/reference/security/ksecattracces...
- pfg 9y ago
  > Can it do full disk encryption? Works with GPG agent? PIV? PKCS11? OTP? U2F? My understanding is that the only use-case is SSH right now, but that could change, I guess. > Requires battery. Not waterproof. Not crushproof. Those are all valid. OTOH, it doesn't require yet another device that can be forgotten or lost, it's far easier to set up (compared to YubiKeys or other smartcards), and it's free. > Can't backup the key? I need to buy two iPhones to have a backup in case one is lost? That's correct. They plan to add paper backups and syncing via QR, IIRC. A second (regular) key that's kept offline would do as well. (FWIW, I use YubiKeys for GPG/SSH/OTP/U2F as well, but I'd definitely recommend this to anyone looking for a cheaper or more usable alternative.)
  - danjoc 9y ago
    >it doesn't require yet another device that can be forgotten or lost iPhones can be lost too. >it's far easier to set up Yubikey can do U2F and OTP out of the package with no setup required. While it can be easier (I wrote a nice shell script for myself), I don't consider setting up a Yubikey for SSH hard for the type of person who uses SSH, https://developers.yubico.com/PIV/Guides/ https://developers.yubico.com/PIV/Guides/ It's literally copy/pasting a few lines out of Yubico's docs into a shell. >it's free So is the Yubikey software. >They plan to add paper backups and syncing via QR, IIRC. I would consider that a fatal flaw. Once the private key is on the device, it should not be easy to recover it from the device.
    - pfg 9y ago
      > iPhones can be lost too. emphasis on yet another. One more thing to keep track of. Not everyone likes to have their (door) keys hanging off their notebooks all day. > Yubikey can do U2F and OTP out of the package with no setup required. Yes, but we're talking about git/ssh here. > While it can be easier (I wrote a nice shell script for myself), I don't consider setting up a Yubikey for SSH hard for the type of person who uses SSH, That's not my experience, but it suppose it might depend on who you know/work with, or in what area you work. > So is the Yubikey software. I was talking about the free beer kind of free, but it's not accurate to say YubiKey is all free (libre) either, it depends on the product. There was quite a controversy a while back[1]. Personally, I'm fine with closed-source security products. Ideological reasons aside, I don't think making decisions based on whether the code is open source makes sense. > I would consider that a fatal flaw. Once the private key is on the device, it should not be easy to recover it from the device. I wouldn't say it's a fatal flaw. You rely on your phone's security to manage access to signing operations anyway, so if an attacker has access to the app, you're pretty much screwed either way. Again, there are trade-offs, but it's a step-up from keeping keys on-device. [1]: https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...