Krypton for Teams
Security and privacy
ssh key management
SHOW HN2018
How HN took it
2 positive, 7 neutral or asking, 1 mixed, 3 critical, out of 13 comments about the project. Thread score +0.03.
Idea: 2 for, 1 againstDesign: 0 for, 1 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Good idea, strong approach to team SSH key management
From 3 comments
Krypton looks awesome! A while ago I made https://www.sshpubkey.com/ to store different ssh public keys across different hosts. But Krypton appears to be a much more intelligent…
hkhanna on HNCool. I started building out something similar-ish once, but used a slack bot instead of mobile. I wasn't as concerned with temporary SSH creds, as much as I just wanted a way to…
sudosteph on HNThis is super cool! Do you have planned support for consensus-type mutlisig access? (ie: needing M of N approvals to acccess resources)
muzakthings on HN
Objections
Long-lived SSH keys conflict with short-lived certificate access management
From 1 comment
Right, but that's a long-lived durable SSH credential. Part of the point of modern SSH access management is not to have any of those anymore.
tptacek on HN
Unclear how personal and work use are separated on the same key
From 2 comments
So I really wanted to use this for our team but hit a few problems. This seems to run on AWS and so does most of our systems if this does not work and with no way to export the…
MightySCollins on HNKrypton supports bluetooth for so even if SQS and SNS are down -- you can still SSH. We'll also shortly be rolling out USB support just incase bluetooth also happens to not be…
agrinman on HN
Security concern about storing keys on a personal phone versus a work laptop
From 1 comment
So I have a Linux laptop with full disk encryption that only gets used for work stuff and lives in the office 5-6 out of 7 days. If I move it, I'm paying attention. Contrast to…
wink on HN
Requests
Support for multisig M-of-N approvals
From 2 comments
This is super cool! Do you have planned support for consensus-type mutlisig access? (ie: needing M of N approvals to acccess resources)
muzakthings on HNYes! This is coming in the next few months. You'll be able to require multiple admins to approve production releases or really lock up sensitive machines. Supervised access…
agrinman on HN
Ability to try local keys before Krypton
From 1 comment
1. All team actions should be prefixed under "kr team", right now i don't know what happens if i run "kr add" if i only want to add myself to a server, ie outside my team. 2.…
apazgo on HN
Team-scoped command prefix and clearer kr add behavior
From 2 comments
1. All team actions should be prefixed under "kr team", right now i don't know what happens if i run "kr add" if i only want to add myself to a server, ie outside my team. 2.…
apazgo on HNProblem with `kr add user@bastion` is that you as `user1` won't normally have access to ssh as `user2`, but "authenticating as one user but modifying another" would work of…
apazgo on HN
Questions
How does it fit with SSH certificate authority and short-lived access?
From 1 comment
How does this work with modern SSH access management? If you were talking to an organization about maybe adopting this, and they told you they were planning in the medium term to…
tptacek on HN
Can private keys be exported if the service is unavailable?
From 1 comment
So I really wanted to use this for our team but hit a few problems. This seems to run on AWS and so does most of our systems if this does not work and with no way to export the…
MightySCollins on HN
Alternatives named
Slack bot for temporary security group access
From 1 comment
Cool. I started building out something similar-ish once, but used a slack bot instead of mobile. I wasn't as concerned with temporary SSH creds, as much as I just wanted a way to…
sudosteph on HN
sshpubkey.com
From 1 comment
Krypton looks awesome! A while ago I made https://www.sshpubkey.com/ to store different ssh public keys across different hosts. But Krypton appears to be a much more intelligent…
hkhanna on HN