kryptco / krypton-android

DEPRECATED Krypton turns your Android device into a U2F Authenticator: strong, unphishable 2FA.
https://krypt.co
Other
202 stars 50 forks source link

app reset data #91

Closed thejmazz closed 6 years ago

thejmazz commented 6 years ago

I was presented with the "let's get started by generating a new key pair" screen today, my phone has been randomly restarting recently so perhaps that is a culprit.

In any case, forced to learn how to rotate public keys now...or I perhaps practice immutable infra with backups to an external source reachable from newly provisioned machines with new public key...

EDIT seems as though a kr transfer was sufficient (made new private key on phone, then scanned QR presented from kr transfer), and I can keep logging into servers with the "old" public key in the authorized_keys file. how is this possible / what is going on behind the scenes?

I ran kr add to one of my servers, then realized my other machines were still accessible w/o kr adding on them

kcking commented 6 years ago

Sorry to hear that! What type of phone are you using, and did you end up discovering what was causing the phone restarts?

kr add adds your krypton public key to a server using an existing way of logging in, such as a local key or a password. If you never removed the original public keys from these servers, then those local keys would still have access. Are there other keys in the authorized_keys file that you have locally?

kcking commented 6 years ago

Closing for now -- please let us know if you run into anything else

thejmazz commented 6 years ago

Ah, sorry for late reply. I'm using a Oneplus One, have not yet discovered what is causing the restarts, it happens occasionally so not such a huge deal.

I think what happened was the app went to the "let's get started screen" and upon creating a key pair, did not actually create a new one, but used the existing one? I surmise this since I did not need to change my public keys anywhere. I.e. I was able to log in to existing servers which only ever had the kr public key, with the same key which was (retrieved?) with the initial app setup (which may or may not have been triggered by my phone's random restarts). In that case the app seemed to successfully recover itself.

kcking commented 6 years ago

Ok thank you for the update. It sounds like your SharedPreferences may have been corrupted during one of those restarts. When generating, we first check if a key exists and re-use that key (since it was not explicitly deleted), which will then re-populate your SharedPreferences with the right public key.