4 ms·

Has this been audited? It sure seems like a wonderful/convenient alternative to hardware keys, but something makes me nervous about the phone aspect. I'd love

by ademup 8y ago

Has this been audited? It sure seems like a wonderful/convenient alternative to hardware keys, but something makes me nervous about the phone aspect. I'd love to read more comments here from those more knowledgeable than I.

ecesena 8y ago
It doesn't seem this can really be FIDO, because FIDO only defines usb, nfc, and ble security keys. I'm not saying Krypton is bad, just that you're installing an extension that (I imagine) interacts with a server to send a push to your phone. It's a very different security model than keys, that require no extension and don't interact with any 3rd party. Update: I'm seeing that my comment is read as negative, and I don't want to give this impression. I think Krypton is great, I use 2FA over push notifications all the times myself. I was just trying to reply to the "has it been audited?" question. Edit: changed chrome extension -> extension according to comment below.
- jiveturkey 8y ago
  It certainly can be FIDO. USB can be virtualized. As far as the authenticating entity is concerned, it is transported over USB.
- orclev 8y ago
  You're wrong about the interaction model. When you install the client on your phone and pair it with a computer (via QR code) it generates a ssh key. You then need to import the public key into your github (or gitlab etc.) account same as you normally would. Once that's done on the client side there's a SSH plugin that is registered that intercepts the authentication request and pings the krypton server to sign your commit with the private key on your phone (the server relays the signing request to your phone via push notification). Assuming you approve everything on your phone the result is unwound back to your ssh client which finishes the handshake with the server and authorizes you based on the public key you had previously uploaded.
- Fnoord 8y ago
  FWIW, its not Chrome-only, which your post might imply. From the FAQ: "The Krypton browser extension currently only works on Google Chrome and Firefox. Safari, and Edge are coming soon." Also, it supports U2F. From the FAQ: "Krypton supports any site that supports U2F security keys." U2F is one of the two protocols supported by the FIDO standard (the other one is UAF). This doesn't say anything about whether this uses FIDO (v1) or FIDO2 though. I think this is pretty cool from a user friendly PoV. Google Android has something similar. The Facebook app doesn't AFAIK (I quit Facebook so cannot verify), but Battle.net does and so does Microsoft Authenticator. The disadvantage is that you need all these separate apps. I'd rather use just one.
- mtgx 8y ago
  Well, we already know that U2F comes "built-in" in some laptops (which I think defeats the purpose of U2F, but that's another issue). And phones makers are starting to adopt "hardware security modules" (just Pixel 2 so far, not sure about the new Samsung ones) and Android 9 is giving app developers access to them via API. So I guess in theory one could turn the phone into an actual "U2F security key," for all intents and purposes?

by ademup 8y ago

ecesena 8y ago

It doesn't seem this can really be FIDO, because FIDO only defines usb, nfc, and ble security keys. I'm not saying Krypton is bad, just that you're installing an extension that (I imagine) interacts with a server to send a push to your phone. It's a very different security model than keys, that require no extension and don't interact with any 3rd party. Update: I'm seeing that my comment is read as negative, and I don't want to give this impression. I think Krypton is great, I use 2FA over push notifications all the times myself. I was just trying to reply to the "has it been audited?" question. Edit: changed chrome extension -> extension according to comment below.

jiveturkey 8y ago
It certainly can be FIDO. USB can be virtualized. As far as the authenticating entity is concerned, it is transported over USB.
orclev 8y ago
You're wrong about the interaction model. When you install the client on your phone and pair it with a computer (via QR code) it generates a ssh key. You then need to import the public key into your github (or gitlab etc.) account same as you normally would. Once that's done on the client side there's a SSH plugin that is registered that intercepts the authentication request and pings the krypton server to sign your commit with the private key on your phone (the server relays the signing request to your phone via push notification). Assuming you approve everything on your phone the result is unwound back to your ssh client which finishes the handshake with the server and authorizes you based on the public key you had previously uploaded.
Fnoord 8y ago
FWIW, its not Chrome-only, which your post might imply. From the FAQ: "The Krypton browser extension currently only works on Google Chrome and Firefox. Safari, and Edge are coming soon." Also, it supports U2F. From the FAQ: "Krypton supports any site that supports U2F security keys." U2F is one of the two protocols supported by the FIDO standard (the other one is UAF). This doesn't say anything about whether this uses FIDO (v1) or FIDO2 though. I think this is pretty cool from a user friendly PoV. Google Android has something similar. The Facebook app doesn't AFAIK (I quit Facebook so cannot verify), but Battle.net does and so does Microsoft Authenticator. The disadvantage is that you need all these separate apps. I'd rather use just one.
mtgx 8y ago
Well, we already know that U2F comes "built-in" in some laptops (which I think defeats the purpose of U2F, but that's another issue). And phones makers are starting to adopt "hardware security modules" (just Pixel 2 so far, not sure about the new Samsung ones) and Android 9 is giving app developers access to them via API. So I guess in theory one could turn the phone into an actual "U2F security key," for all intents and purposes?