Hacker News Reader

Comment by ecesena | Hacker News Reader

It doesn't seem this can really be FIDO, because FIDO only defines usb, nfc, and ble security keys.

I'm not saying Krypton is bad, just that you're installing an extension that (I imagine) interacts with a server to send a push to your phone. It's a very different security model than keys, that require no extension and don't interact with any 3rd party.

Update: I'm seeing that my comment is read as negative, and I don't want to give this impression. I think Krypton is great, I use 2FA over push notifications all the times myself. I was just trying to reply to the "has it been audited?" question.

Edit: changed chrome extension -> extension according to comment below.

View on HN

You're wrong about the interaction model. When you install the client on your phone and pair it with a computer (via QR code) it generates a ssh key. You then need to import the public key into your github (or gitlab etc.) account same as you normally would. Once that's done on the client side there's a SSH plugin that is registered that intercepts the authentication request and pings the krypton server to sign your commit with the private key on your phone (the server relays the signing request to your phone via push notification). Assuming you approve everything on your phone the result is unwound back to your ssh client which finishes the handshake with the server and authorizes you based on the public key you had previously uploaded.

FWIW, its not Chrome-only, which your post might imply.

From the FAQ:

"The Krypton browser extension currently only works on Google Chrome and Firefox.

Safari, and Edge are coming soon."

Also, it supports U2F. From the FAQ:

"Krypton supports any site that supports U2F security keys."

U2F is one of the two protocols supported by the FIDO standard (the other one is UAF). This doesn't say anything about whether this uses FIDO (v1) or FIDO2 though.

I think this is pretty cool from a user friendly PoV. Google Android has something similar. The Facebook app doesn't AFAIK (I quit Facebook so cannot verify), but Battle.net does and so does Microsoft Authenticator. The disadvantage is that you need all these separate apps. I'd rather use just one.

Well, we already know that U2F comes "built-in" in some laptops (which I think defeats the purpose of U2F, but that's another issue).

And phones makers are starting to adopt "hardware security modules" (just Pixel 2 so far, not sure about the new Samsung ones) and Android 9 is giving app developers access to them via API.

So I guess in theory one could turn the phone into an actual "U2F security key," for all intents and purposes?

It certainly can be FIDO. USB can be virtualized. As far as the authenticating entity is concerned, it is transported over USB.

Reply on news.ycombinator.com