Show HN: Kryptonite – a new home for your SSH private key

It sounds very hipster and all, but how is a phone more trustworthy than a Linux PC? Cool, we don't need to trust a PC, now we have to trust a phone and pretend that malware for smartphones don't exist at all. Hardware USB token looks much better as its attack surface is so much smaller than iOS/Android.

What is the business model here? They release what they purport to be their source code on Github, but under a license that prohibits ... everything (literally the words "All Rights Reserved"). So clearly they want to sell that, and then have the open source community debug it for them for free, which I just don't see happening. With no way to validate that the source code on Github is what ends up in their compiled binaries, I don't see…

If the machine is silently compromised, moving the private key one step away doesn't matter much; kryptonite will serve the signature regardless, and the attacker can cherry pick the active session keys. Yes, it's a partial break, but given the fact that the private key can be stolen from the phone too, using kryptonite just increased the attack surface overall. Ofering no private key backup isn't a simple matter of 'just reupload your public key'. This works for services that…

It seems to be part of Akamai since last year. Surprised the website is not completely taken down.