Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Keybase Chat

keybase.io

Post reply on HN
Print view View original

11–20 of 201 posts

Re: Introducing Keybase Chat

#11

Post by malgorithms »

coldpie wrote: post #8
malgorithms wrote: post #2

OP here! I had to trim the post down for brevity, but I thought the HN community in particular might be interested in the API side of things. Undocumented in the post: you can invent channels for app-to-app communication from the JSON API. For example, it's possible with Keybase chat to have a program posting encrypted messages for another person or program, without cluttering up the visual chat interface. Also - to…

This is cool. One thing that keeps me from using Slack, &c is that I don't trust my information to be stored on their servers. Keybase's combination of private keys and open source tools and protocols makes me comfortable with your server-side storage. Your post does a good job describing what is stored in a readable format on your servers. One thing I didn't understand is where the data sent to users not yet on Keyb…

oh, great question! I wish I'd been clearer in the post.

Encrypted messages waiting for others are stored on Keybase servers. But they're encrypted only for the sender. The important requirement of this protocol is the removal of extra human steps, especially the ones before composing a message. The only thing a person should have to do is (a) write a message and (b) maybe tell the recipient it's waiting for them on keybase.

It's the worst to ask someone for their number or email before you get to compose a message.

There are still computer steps, however, and Keybae hides them from you. If you post an encrypted message for foo@reddit, then you sign a statement to yourself that foo@reddit is an intended recipient. When foo@reddit proves herself by announcing a key, your own client verifies the announcement and rekeys the content for her, assuming her key proof matches your signed assertion. This is no work for you, although it does require that one of your devices comes online. If they try to get to the content and all of your devices are off, they'll see a message that the original sender needs to come online before it's available for the first time.

The story with phones will be even better, as they're easier to reach through push notifications.

As with most large data encryption, this is performed by rekeying a symmetric key. So you can leave a huge attachment for foo@reddit and you don't have to download/upload the data all over again just to make it available.

As for spam prevention...we're still discussing. We obviously don't have the ability to study message contents. At the very least, we will need to have easy/clear blocking features

Re: Introducing Keybase Chat

#12

Post by Nadya »

It'll be interesting to see if I ever receive messages from my fellow HN users now that it's a bit easier to do so without navigating my website to find my email address. I doubt it, but still.

I'll give it a run when I get home today. Since few of my contacts use Keybase, or would have any interest in Keybase, this is less "Wow! Awesome!" for me than the release of KBFS was - but it's still pretty cool.

I love how Keybase is expanding to be more than just a collection of "internet personas verified by a PGP signature" and am interested in what else you guys may have in the works.

E: Updated my profile info to make mention of Keybase Chat. And I don't even have it yet. ;)

Re: Introducing Keybase Chat

#13

Post by primigenus »

Hey malgorithms, this is great! I check the Keybase website every month or so for updates and discovered yesterday that there's a new logo, replacing the old thieving dog/ferret/raccoon with what appears to be a person's head with their hair in a bun holding a key. Can you give some background on the thinking behind this logo redesign? (Sorry it's not a question about chat, per say)

Re: Introducing Keybase Chat

#14

Post by coffeemug »

That looks spectacular, can't wait to try it tonight. Hope this software can overcome the network effects of existing systems. End-to-end encryption is really, really important, but I feel like the real game changer is being able to instantly chat with anybody online by just typing in their username.

Re: Introducing Keybase Chat

#15

Post by accountface »

primigenus wrote: post #13

Hey malgorithms, this is great! I check the Keybase website every month or so for updates and discovered yesterday that there's a new logo, replacing the old thieving dog/ferret/raccoon with what appears to be a person's head with their hair in a bun holding a key. Can you give some background on the thinking behind this logo redesign? (Sorry it's not a question about chat, per say)

Looks like it's a bit more friendly than some creepo raccoon

Re: Introducing Keybase Chat

#16

Post by edraferi »

alexkadis wrote: post #6

Is it technically possible for Signal/Whatsapp to use Keybase keys in lieu of phone numbers? If so, how practical would it be to add this as an option?

I wonder how that would work with key rotation. Those chat services do a lot of key management for you during a conversation, while Keybase is more focused on long-lived keys.

Re: Introducing Keybase Chat

#17

Post by coldpie »

malgorithms wrote: post #11
coldpie wrote: post #8

Earlier quoted context omitted.

This is cool. One thing that keeps me from using Slack, &c is that I don't trust my information to be stored on their servers. Keybase's combination of private keys and open source tools and protocols makes me comfortable with your server-side storage. Your post does a good job describing what is stored in a readable format on your servers. One thing I didn't understand is where the data sent to users not yet on Keyb…

oh, great question! I wish I'd been clearer in the post. Encrypted messages waiting for others are stored on Keybase servers. But they're encrypted only for the sender . The important requirement of this protocol is the removal of extra human steps, especially the ones before composing a message. The only thing a person should have to do is (a) write a message and (b) maybe tell the recipient it's waiting for them on…

> Keybae

I hope this is an internal nickname ;)

Thanks for expanding, and I wish you luck on the spam prevention. We often have conversations in the office about implementing a cost-based anti-spam system[1] for email, but I think a lack of universal usage kills that idea before it can begin. Keybase may be in a position to implement it before the protocol and user interfaces have ossified. Something to think about.

I find this stuff fascinating. Deciding not to interview with you guys because I didn't want to move remains one of the biggest "what if"s of my career so far :)

[1] https://en.wikipedia.org/wiki/Cost-based_anti-spam_systems

Re: Introducing Keybase Chat

#18

Post by bgentry »

This really does look great.

Edit: since I haven't been running Keybase for the past 2 weeks, I missed the fact that they disabled continuous background proof verification due to my concerns: https://github.com/keybase/keybase-issues/issues/2782#issuec...

Good on them! The rest of this comment is not actually applicable anymore and you should give Keybase Chat a try :)

Original comment:

-----------------

My biggest concern with it, however, is that the Keybase client is now frequently verifying all my contacts' proofs. Many of these verifications are for personal websites and are done over port 80 or involve DNS lookups that my contacts control.

This leaks a great deal of metadata over the network about who my contacts are, and makes it easy for a hostile network to determine who I am if I'm running the Keybase app.

I reported this on GitHub when I noticed it and have unfortunately not been regularly running the Keybase app since: https://github.com/keybase/keybase-issues/issues/2782

I hope they decide on some sort of fix for this. They could at least not do verifications over insecure connections and arbitrary 3rd party DNS lookups without my explicit approval.

Re: Introducing Keybase Chat

#19

Post by Nadya »

accountface wrote: post #15
primigenus wrote: post #13

Hey malgorithms, this is great! I check the Keybase website every month or so for updates and discovered yesterday that there's a new logo, replacing the old thieving dog/ferret/raccoon with what appears to be a person's head with their hair in a bun holding a key. Can you give some background on the thinking behind this logo redesign? (Sorry it's not a question about chat, per say)

Looks like it's a bit more friendly than some creepo raccoon

Not only that - but a "thieving raccoon" helps reinforce the mistaken belief that crypto is only for criminals. While I don't think that had a "serious" effect or that people would read so heavily into a logo - it never sat well with me. While I didn't notice the logo change until the GP post pointed it out, I like the new one better.

Re: Introducing Keybase Chat

#20

Post by edraferi »

edraferi wrote: post #16
alexkadis wrote: post #6

Is it technically possible for Signal/Whatsapp to use Keybase keys in lieu of phone numbers? If so, how practical would it be to add this as an option?

I wonder how that would work with key rotation. Those chat services do a lot of key management for you during a conversation, while Keybase is more focused on long-lived keys.

Found the relevant part of the post:

How Keybase solves this problem:

End-to-end encrypt all messages, but only "exploding messages" (coming soon) will have FS. Therefore, your history will survive, encrypted, except for the messages you choose.

Post reply on HN