So how exactly does it open a truly secure chat with someone else? If it is encrypting messages, then the recipient would have to have my public key to decrypt the message, right? But if keybase is sending the recipient my public key, then doesn't keybase have the ability to decrypt my messages, too? And if keybase can do that, than can't everyone else that is watching the public key go over the wire decrypt my messa…
Keybase is out for iPhone, Android
31–40 of 114 posts
Re: Keybase is out for iPhone, Android
#32Could someone explain how the underlying keys are managed for Keybase mobile? I'm guessing as part of sign up you generate a unique key just for your mobile device, and if your mobile device is lost, you'll need to generate a new key? How does this dovetail with your desktop key? Does resetting any active key trigger a re-proof of each your identity services (i.e. Twitter, GitHub, etc.) Looks very cool overall!
They have a blog post of their key model. [0] If you lose your device you shouldn't have to re-prove your identity on all services just any that you proved using that particular key. [0] https://keybase.io/blog/keybase-new-key-model
First part: if you lose or wipe a phone and want to reprovision, the lost device's private key is GONE. It will not exist in some icloud backup. When you provision your new device, the Keybase app will make fresh keys. To make that device yours, you'll need to either (a) bring together another keybase device, or (b) enter a paper key. When you do that, the old key will sign your newly generated key, and the new key will countersign. The old key will also be used to decrypt and reencrypt access keys for your data, so you can get to your old messages and files. Your data will live on. So even in an extreme example: if you write data in KBFS or send a chat message, provision a new device, and then revoke all your old devices, you'll still have the data on the new device. Assuming at some point you always held at least one of your private keys.
The general rule of thumb here is as long as you don't lose all your devices (and in this sense you can think of a paper key as a device), you won't lose your files in kbfs/chat.
The reason the answer above wasn't 100% correct: the revocation of a device (by another) does not trigger an identity re-proof, even for proofs made by the revoked device. Why? well, the original identity announcement is in a well-ordered signature chain of your announcements, and at the same time you remove it, you also have the power to remove your twitter or other proofs. By choosing not to do that AND leaving up your twitter announcement, it's pretty clear you're still you. This isn't like PGP where revocations and statements are floating around and could be ordered in any-which-way.
1. key X adds key Y
2. key X adds twitter
3. key Y revokes X (leaving twitter proof)
the twitter proof is considered still valid in Keybase's logic. Because 1,2,3 exist in a signed chain and Y had the power to remove twitter but chose not to.
One final point we've made in multiple places: your PGP key is part of your identity on Keybase (like your Twitter account or HN account), but it isn't used as a key in Keybase chat or the filesystem for a variety of reasons. So really, your Keybase-data is protected by your devices+paper keys. Just don't run out of them!
Re: Keybase is out for iPhone, Android
#33So how exactly does it open a truly secure chat with someone else? If it is encrypting messages, then the recipient would have to have my public key to decrypt the message, right? But if keybase is sending the recipient my public key, then doesn't keybase have the ability to decrypt my messages, too? And if keybase can do that, than can't everyone else that is watching the public key go over the wire decrypt my messa…
This is the general idea of how public/private key crypto works. The actual Keybase implementation is a bit more complicated because a person doesn't have exactly one public/private keypair, but rather keys for each device.
Re: Keybase is out for iPhone, Android
#34> By using the Keybase app you agree to the following terms: you'll be a nice Internet person. Unfortunately, Keybase cannot be considered free software because of this clause.
If I give Keybase a not nice review will they revoke my license?
Re: Keybase is out for iPhone, Android
#35Oh great... the application is not available in France (!). GooglePlay refuses to let me download the app. And the website does not provide a direct link to the apk (only direct links to desktop apps). Will I have to download the app from dubious third-party stores ? :-(
Re: Keybase is out for iPhone, Android
#36So how exactly does it open a truly secure chat with someone else? If it is encrypting messages, then the recipient would have to have my public key to decrypt the message, right? But if keybase is sending the recipient my public key, then doesn't keybase have the ability to decrypt my messages, too? And if keybase can do that, than can't everyone else that is watching the public key go over the wire decrypt my messa…
When you send a message, you encrypt it with their public key, so that only they can decrypt it. Additionally, you sign the message with your private key, so the person who receives the message can verify that you signed it, by using your public key. This is the general idea of how public/private key crypto works. The actual Keybase implementation is a bit more complicated because a person doesn't have exactly one pu…
Re: Keybase is out for iPhone, Android
#37Great work, thanks!
Re: Keybase is out for iPhone, Android
#38Re: Keybase is out for iPhone, Android
#39Earlier quoted context omitted.
How did you manage to get something written in Go into the iOS app store? I was under the impression that foreign binaries weren't allowed.
This was brought up a couple days ago during discussion of a game built in Rust on the app store. A comment there[0] claims that the restriction on languages is no longer in the guidelines. [0] https://news.ycombinator.com/item?id=14302931
> This rule got so much press 7 years ago that it will be one of those "truths" about a platform that never dies on internet forums, that and the Playstation platforms using OpenGL as their primary API...
Re: Keybase is out for iPhone, Android
#40> By using the Keybase app you agree to the following terms: you'll be a nice Internet person. Unfortunately, Keybase cannot be considered free software because of this clause.
I am speculating that the clause is intended to be part of the Keybase terms of service, but because the software and service are tightly coupled, it is phrased as a software license restriction.