Show HN: Send encrypted secrets from the command line • Hacker News Board

Re: Show HN: Send encrypted secrets from the command line

#41

Post by paulfurley » Fri, Jan 11, 2019, 9:59 AM UTC

tptacek wrote: post #31

The tool for this that everyone I know uses is Magic Wormhole. Wormhole has a more straightforward security model and is more thoughtfully designed: it uses a PAKE and relies on out-of-band secret sharing, rather than attempting a registry of "verified" public keys. You should probably just use Wormhole. pip install magic-wormhole

That's cool, and I'm going to give it a go: thanks for raising it.

> The two endpoints are identified by using identical "wormhole codes": in general, the sending machine generates and displays the code, which must then be typed into the receiving machine. > The codes are short and human-pronounceable, using a phonetically-distinct wordlist. The receiving side offers tab-completion on the codewords, so usually only a few characters must be typed. Wormhole codes are single-use and do not need to be memorized.

I love that they've put some thought into usability here: that's nice.

Re: Show HN: Send encrypted secrets from the command line

#42

Post by paulfurley » Fri, Jan 11, 2019, 10:02 AM UTC

huhtenberg wrote: post #28

paulfurley wrote: post #16

Earlier quoted context omitted.

Thanks! Yes, we're currently hosting public keys. > Is a self-hosted version of the same possible? The honest answer is, we're not sure yet. It's our strong ambition to make Fluidkeys into an honest, you're-the-customer business, and we aren't sure how we'll license the server. Is self-hosting something your team would be willing to pay for? If so, that might help our business model development! :) > a) Some sort of…

> It's our strong ambition to make Fluidkeys into an honest, you're-the-customer business Without sugar-coating it - a service like this, with the scope it has now, has * zero * chance of successful monetization. 100% guaranteed. This is a cosmetic service that aims to address a security need. People who actually need this AND have money to pay for it are in position to explore self-hosted options, which is what they…

That's a thoughtful analysis, thanks. I appreciate the lack of sugar coating :)

Re: Show HN: Send encrypted secrets from the command line

#43

Post by paulfurley » Mon, Jan 14, 2019, 9:35 AM UTC

mmcclure wrote: post #34

paulfurley wrote: post #14

Earlier quoted context omitted.

I'm a user but no expert about keybase. As far as I can tell they've pivoted to taking on Slack & friends with zero-knowledge team-chat, but global. Good luck to them! We're not in a hurry to try and move people off Slack or GnuPG: teams have their existing services (Slack, G-suite) and other workflows like Thunderbird + Enigmail, git signing etc. We think complementing those existing flows is the way to go. The long…

> As far as I can tell they've pivoted to taking on Slack & friends with zero-knowledge team-chat, but global. What? I'm pretty curious what gave you this impression, as I've always seen their chat app as an interesting use built on top of their encrypted file system work, but in no way their primary use-case or business. We (and everyone else I know that uses Keybase) use it for passing around sensitive information,…

Thanks for pushing back on this.

> We (and everyone else I know that uses Keybase) use it for passing around sensitive information, either through chat, their encrypted Git repos, encrypted messages plopped into emails, etc.

That is interesting. I'm gonna put my hand up and admit I haven't done my homework here. It's been a while since I used it properly and I've relied too heavily on their website:

> Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server can't leak your files or be hacked.

> I think Fluidkeys is cool and all, but I definitely wouldn't switch off of Keybase for it,

Thanks, and I wouldn't expect you to have to switch. We're gonna think properly about where we're competing. I appreciate your input.