3 ms·

This is going to change everything for me. You sirs, have cracked the hard problem: how do we make U2F easy enough for users to use without taking away the "som

This is going to change everything for me. You sirs, have cracked the hard problem: how do we make U2F easy enough for users to use without taking away the "something you have" aspect of it. This is brilliant. I love it! Now please fix the licensing, make the core open-source, be a bit more transparent, and get audited. It would really inspire a lot more confidence in a tool whose target audience is currently the security paranoid crowd.

danieldk 8y ago
I thought they already open source various parts, including the command-line client, iOS and Android applications? https://github.com/kryptco https://github.com/kryptco Edit: I didn't realize that they publish the source code, but with a non-FLOSS license.
jiveturkey 8y ago
> You sirs, have cracked the hard problem That's completely unfair. U2F was from the start designed to be rendered in this kind of form factor. "All" Krypton (and Duo, BTW) did was implement this obvious form factor. U2F itself, was the hard problem. And anyway, push 2FA has been around for approx. as long as U2F. It may not be obvious now, but U2F will ultimately die in favor of push. IMHO. (they each have strengths and weaknesses but overall push is better.)
- mtgx 8y ago
  Push = some company owns your 2FA credential, right? Or were you talking about something else?
  - mplewis 8y ago
    I think push means when you sign in, the server pushes a notification to your phone(s), which can accept or reject the request.
    - ztjio 8y ago
      It feels exactly the same to use krypton. You pop up the website that wants auth and your phone dings and you tap a button and there you go. Compared to say, Blizzard's authenticator for battle.net, it does the same thing. You try to log in, it pushes a message to your phone you get a ding tap a button and you go. As far as UX goes it's identical to the user.
      - amingilani 8y ago
        But there in lies the difference. With Krypton, the company doesn't own your keys, you so. It's like Fiat vs Bitcoin.. only there's literally no difference in experience. That's why Krypton is better. It works everywhere U2F (an open spec) is supported, while the proprietary company solution is supported where the company has partnered
- amingilani 8y ago
  Correct me if I'm wrong but I think you're confusing U2F (the open standard) with a second factor of authentication (the thing) U2F has traditionally been distributed in the form of physical tokens. It's an open standard compared to Duo's. (The rest is just copied off another comment I made down this thread) But there in lies the difference. With Krypton, the company doesn't own your keys, you do. It's like Fiat vs Bitcoin.. only there's literally no difference in experience. That's why Krypton is better. It works everywhere U2F (an open spec) is supported, while the proprietary company solution is supported where the company has partnered

danieldk 8y ago

I thought they already open source various parts, including the command-line client, iOS and Android applications? https://github.com/kryptco https://github.com/kryptco Edit: I didn't realize that they publish the source code, but with a non-FLOSS license.

jiveturkey 8y ago

> You sirs, have cracked the hard problem That's completely unfair. U2F was from the start designed to be rendered in this kind of form factor. "All" Krypton (and Duo, BTW) did was implement this obvious form factor. U2F itself, was the hard problem. And anyway, push 2FA has been around for approx. as long as U2F. It may not be obvious now, but U2F will ultimately die in favor of push. IMHO. (they each have strengths and weaknesses but overall push is better.)

mtgx 8y ago
Push = some company owns your 2FA credential, right? Or were you talking about something else?
- mplewis 8y ago
  I think push means when you sign in, the server pushes a notification to your phone(s), which can accept or reject the request.
  - ztjio 8y ago
    It feels exactly the same to use krypton. You pop up the website that wants auth and your phone dings and you tap a button and there you go. Compared to say, Blizzard's authenticator for battle.net, it does the same thing. You try to log in, it pushes a message to your phone you get a ding tap a button and you go. As far as UX goes it's identical to the user.
    - amingilani 8y ago
      But there in lies the difference. With Krypton, the company doesn't own your keys, you so. It's like Fiat vs Bitcoin.. only there's literally no difference in experience. That's why Krypton is better. It works everywhere U2F (an open spec) is supported, while the proprietary company solution is supported where the company has partnered
amingilani 8y ago
Correct me if I'm wrong but I think you're confusing U2F (the open standard) with a second factor of authentication (the thing) U2F has traditionally been distributed in the form of physical tokens. It's an open standard compared to Duo's. (The rest is just copied off another comment I made down this thread) But there in lies the difference. With Krypton, the company doesn't own your keys, you do. It's like Fiat vs Bitcoin.. only there's literally no difference in experience. That's why Krypton is better. It works everywhere U2F (an open spec) is supported, while the proprietary company solution is supported where the company has partnered