3 ms·
The parent comment literally said arguably, as in, can be argued and is based on personal choice. And, although I'm not the commenter, it doesn't read anywhere
by mynameisvlad 9y ago
The parent comment literally said arguably, as in, can be argued and is based on personal choice.
And, although I'm not the commenter, it doesn't read anywhere near it trying to imply Kryptonite is a replacement for Yubikey. They were replying to someone comparing it to the 2FA PAM module, and explaining it's more like a smartcard or Yubikey in that it stores the key, rather than add a second verification outside the key.
- danjoc 9y agoI asked the questions because I'd like to know the answer. I'm not arguing passive aggressively. I looked at the source repo, and at a glance, it looks like the app stores the key pair on the iOS keychain. My guess is that means the key can be removed from the device if the user chooses to do so, or if the user give access to the keychain to another application. Perhaps I'm wrong about that. I keep hearing "The key never leaves the device" repeated, and I'd mainly like to know how that guarantee is made.
- pfg 9y agoThe app uses kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly[1]. Quoting the relevant iOS documentation[2]: > After the first unlock, the data remains accessible until the next restart. This is recommended for items that need to be accessed by background applications. Items with this attribute do not migrate to a new device. Thus, after restoring from a backup of a different device, these items will not be present. [1]: https://github.com/kryptco/kryptonite-ios/blob/42c71d6381def40e1322f3b951a395f2c6e65178/Kryptonite/KeyPair.swift#L35 https://github.com/kryptco/kryptonite-ios/blob/42c71d6381def... [2]: https://developer.apple.com/reference/security/ksecattraccessibleafterfirstunlockthisdeviceonly https://developer.apple.com/reference/security/ksecattracces...