Has this been audited? It sure seems like a wonderful/convenient alternative to hardware keys, but something makes me nervous about the phone aspect. I'd love to read more comments here from those more knowledgeable than I.
I'm not saying Krypton is bad, just that you're installing an extension that (I imagine) interacts with a server to send a push to your phone. It's a very different security model than keys, that require no extension and don't interact with any 3rd party.
Update: I'm seeing that my comment is read as negative, and I don't want to give this impression. I think Krypton is great, I use 2FA over push notifications all the times myself. I was just trying to reply to the "has it been audited?" question.
Edit: changed chrome extension -> extension according to comment below.
From the FAQ:
"The Krypton browser extension currently only works on Google Chrome and Firefox.
Safari, and Edge are coming soon."
Also, it supports U2F. From the FAQ:
"Krypton supports any site that supports U2F security keys."
U2F is one of the two protocols supported by the FIDO standard (the other one is UAF). This doesn't say anything about whether this uses FIDO (v1) or FIDO2 though.
I think this is pretty cool from a user friendly PoV. Google Android has something similar. The Facebook app doesn't AFAIK (I quit Facebook so cannot verify), but Battle.net does and so does Microsoft Authenticator. The disadvantage is that you need all these separate apps. I'd rather use just one.
And phones makers are starting to adopt "hardware security modules" (just Pixel 2 so far, not sure about the new Samsung ones) and Android 9 is giving app developers access to them via API.
So I guess in theory one could turn the phone into an actual "U2F security key," for all intents and purposes?