Show HN: Kryptonite – a new home for your SSH private key

Re:Show HN: Kryptonite – a new home for your SSH private key by 4kevinking on Monday May 01, 2017 @04:58PM (#14241509)

The attack surface may seem smaller for USB tokens, but storing the pin for say a Yubikey allows malware to use the key without restriction. Also, these USB devices don't have a UI, so you never know what you are actually approving, i.e. which username or server you are logging into.

[ Parent | on HN ]

Re:Show HN: Kryptonite – a new home for your SSH private key by packetized on Monday May 01, 2017 @06:53PM (#14242487)

Erm, not true - changing the Yubikey setting to require a touch for key use (S/C/E) is trivial. Malware can't use it without restriction if it requires you to physically touch it every time you want to approve use.

[ Parent | on HN ]

Re:Show HN: Kryptonite – a new home for your SSH private key by 4kevinking on Monday May 01, 2017 @07:04PM (#14242568)

Point taken. Unfortunately when you touch the key you still can't verify exactly what you are approving.

[ Parent | on HN ]

Re:Show HN: Kryptonite – a new home for your SSH private key by simonvc on Tuesday May 02, 2017 @08:51AM (#14245918)

There's a GPG/SSH applet for the ledger Nano S now that has a tiny screen and buttons...

[ Parent | on HN ]

Re:Show HN: Kryptonite – a new home for your SSH private key by wwwv on Monday May 01, 2017 @07:30PM (#14242722)

So, capture the auth and use it for the malware, show the user some failure and allow their retry to pass. Stupid dodgy Yubikey fails half the time.

[ Parent | on HN ]