Hacker News Reader

Comment by eof | Hacker News Reader

Why do I want my private key on my phone instead of the computer where I am using it?

Any user-level application on your computer can read the SSH key -- you'll never know if it's used or sent off somewhere. Even passphrase encrypted keys are vulnerable. Check out this blog post for a deep dive on our threatmodel and why you should store your SSH key on your phone https://blog.krypt.co/why-store-an-ssh-key-with-kryptonite-9...

Well the phone is at least equally insecure, given it's often way more opaque than a computer.

No, the opposite is true. See upthread.

I'd like to know this too. My computer is patched daily, my phone less often.

Respectfully, this is easy: get a better phone and turn autoupdate on.

Also respectfully, he stated patched daily. Generally, security updates for both iOS and Android devices happen in a monthly roll-up.

If your checklist for being "secure" involves being up-to-date, there is no amount of 'getting a better phone' that will put it on par with a desktop OS that receives daily patches.

This is simply not true. No matter how often you patch your Linux desktop, it is less secure than an iPhone.

Conflating secure with up-to-date is wrong in such a broad and sweeping statement such as 'your Linux desktop is always less secure than an iPhone'.

Updates software does not instantly mean more secure, which I am sure you are aware of.

As you stated, for the generalists, yes, an out-of-the-box iPhone has more hardening than an OOTB Linux desktop, but for the type of person on HN, this is not necessarily true at all. There are too many variables.

I disagree, but that's fine.

I guess its like 2 factor authentication - I can let a friend use my computer & not worry about them SSHing in to my server. Or I could just create a 2nd account on the computer instead of using Kryptonite (easier in my opinion).

I also have to wonder what kinds of backdoor access the NSA has to my phone.

Even if your computer is 100% compromised, SSH can't be used without your explicit permission and knowledge.

I think you're saying that if you use this app, and remove other ssh keys from your computer, then "SSH can't be used without your explicit permission and knowledge.".

I agree with another commentator, I trust my PC more than I trust my phone. The latter is probably already compromised.

Reply on news.ycombinator.com