Hacker News Reader

Comment by akerl_ | Hacker News Reader

Are the communications between the phone and the computer going via the kryptonite servers?

No -- we treat every communication channel as untrusted. All communication between the phone and computer is encrypted with session keys established when you pair by scanning the QR code in the terminal. Check out our architecture post for more details: https://blog.krypt.co/the-kryptonite-architecture-a385e7aaa3...

If I'm reading this, the answer is actually ~Yes? The requests pass via SQS/SNS run by Kryptonite, or via Bluetooth not run by kryptonite?

Indeed, (encrypted) requests pass through SQS/SNS with credentials owned by us. We can see the amount of traffic, but not any of its contents or who sent it.

Is there an option to configure this to run across only BT?

This would mean that the phone needs to be physically close in order to accomplish auth and I would think that's a good requirement based the premise of this app.

Follow-up: Since it seems all the code is open-source, is it possible for me to run this service on my own server (or at least in my own AWS setup)?

The lack of a license leaves this very unclear.

GitHub's user agreement allows for the free use of any code posted in a public repo.

No, it doesn't. Standard copyright applies if there is no licence.

GitHub user agreement allows other users to view and make copies of your content on github but not for "free use" in general.

https://help.github.com/articles/github-terms-of-service/#5-...

Reply on news.ycombinator.com