3 ms·
Can someone explain how this works!? I have looked all over the Krypt website but I still don't get it?!
by dabeeeenster 8y ago
Can someone explain how this works!? I have looked all over the Krypt website but I still don't get it?!
- dabeeeenster 8y agoOK finally found it in the FAQ for those that are slow like me: Is "zero touch" secure? How is it a second factor if it approves automatically? Yes, zero touch is safe. The security behind Krypton is established when you pair Krypton with your browser (via the extension) by scanning the QR code. This ensures that only your specific browser will be able to talk to Krypton. Krypton and your browser establish a secure cryptographic channel using keys that only your phone and computer have. There is NO trusted third-party. Two-factor is simply a way to defend against compromised passwords. If someone knows your password and attempts to login then they'll be hit with a second-factor challenge. Since this attacker is remote and doesn't have access to your browser they won't be able to talk to Krypton.
- lostmsu 8y agoIf they steal password from your browser by, say, installing keylogger, that same keylogger can now also steal the computer side Krypton key. So zero touch does not help against that class of attacks, while normal U2F would.