Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase launches encrypted Git

keybase.io

Post reply on HN
Print view View original

201–210 of 277 posts

Re: Keybase launches encrypted Git

#201

Post by strib »

paule89 wrote: post #72

just to clarify: 1. Do you need a private git repository? 2. Is everything really encrypted? 3. If everything is encrypted how can i access it through Git Desktop?

You can have team-based or private repos hosted by Keybase. Everything is encrypted and signed before it leaves your computer, and decrypted and verified when your computer downloads it. But your local checkout of that git repo is unencrypted. It's just a normal repo. So Github Desktop has full access to it, like it does for all files in your local filesystem.

Re: Keybase launches encrypted Git

#202

Post by JonathonW »

chipx86 wrote: post #165
malgorithms wrote: post #24

Earlier quoted context omitted.

We believe the right long-term answer for Keybase is finding a way to charge large corporations and offer pretty much everything else for free. Obviously there would have to be some paid tier if you really wanted 10TB of storage or something, but very few people want that right now. We're still just getting started. Of course to achieve our goal, we'll also have to find a way to distinguish communities - which we'll…

Throwing my "I It seems to me that there's a lot of product opportunities in the corporate world that go beyond what Keybase is providing today. Chat and Git are interesting, but there's already a lot of momentum in both these areas. Been thinking how I use encryption and where things fall short today. One of those areas is build signing and hardware key management for our team. Everything that goes on our servers ge…

On the document management end of things: that's exactly what the public/yourname/ subdirectory of KBFS is-- every document there gets signed when edited, then they're automatically verified (by the KBFS client) when someone tries to download them (either the original author, or another Keybase user).

There's no explicit signing process involved, but that's part of Keybase's value proposition: automatic and transparent public key cryptography.

Re: Keybase launches encrypted Git

#203

Post by im_down_w_otp »

Foxboron wrote: post #3
malgorithms wrote: post #2

Keybase team member here. Interesting fact: git doesn't check the validity of sha-1 hashes in your commit history. Meaning if someone compromises your hosted origin, they can quietly compromise your history. So even the fears about data leaks aside, this is a big win for safety. From an entrepreneurial perspective, this is my favorite thing we've done at Keybase. It pushes all the buttons: (1) it's relatively simple,…

While talking about git and security: Signing tags are not as affective as you'd think. refs are never actually signed, it's the objects they are pointing at that are signed. This opens up to interesting attacks where you can move refs around to previous vulnerable versions. Git also never checks if the metadata the tag points at is correct! Interesting paper: https://www.usenix.org/system/files/conference/usenixsecu…

Yeah, we implemented this paper's proposal (their version has some bugs, gaps, and infinite loop issues) where I work to be able to have higher assurance on the validity of our source repositories.

First version in shell with a fairly robust test suite, and the next version in Rust. Originally started to do it in Rust, but libgit2 was sufficiently obtuse that we opted for getting to a complete, working thing first.

Re: Keybase launches encrypted Git

#204

Post by eridius »

pkamb wrote: post #183
ThatGeoGuy wrote: post #152

Earlier quoted context omitted.

To expand on this, you need to add the fork as an alternate remote (as opposed to origin), and then replace "origin" in the command posted prior.

So it's not possible from a fork, if you've only added the original repo as your single remote? Currently I add the random person's fork as a remote to inspect/modify their PR branch. Was hoping for some GitHub magic to eliminate this step.

It is possible. You can specify a URL instead of a remote name for `git fetch`.

Re: Keybase launches encrypted Git

#205

Post by chipx86 »

JonathonW wrote: post #202
chipx86 wrote: post #165

Earlier quoted context omitted.

Throwing my "I It seems to me that there's a lot of product opportunities in the corporate world that go beyond what Keybase is providing today. Chat and Git are interesting, but there's already a lot of momentum in both these areas. Been thinking how I use encryption and where things fall short today. One of those areas is build signing and hardware key management for our team. Everything that goes on our servers ge…

On the document management end of things: that's exactly what the public/yourname/ subdirectory of KBFS is-- every document there gets signed when edited, then they're automatically verified (by the KBFS client) when someone tries to download them (either the original author, or another Keybase user). There's no explicit signing process involved, but that's part of Keybase's value proposition: automatic and transpare…

If you can tie the shield into KBFS, that's even better. It's not enough to protect a company from attacks, though. People may still click that random document coming in via e-mail that claims to be from a co-worker. A mandatory technical solution on that end, no matter what the actual technology looks like under the hood, would be essential for protecting people from making these kinds of mistakes.

The value proposition of automatic and transparent public key cryptography is strong, and what I love about Keybase. Just thinking of other ways that can be applied transparently.

Re: Keybase launches encrypted Git

#206

Post by rcthompson »

It's amazing how many new features and even new complete products Keybase has been able to build on top of their core in such a short span of time. Even more so considering that a large part of that core is "just" a much better UX for a technology (GPG) that has existed for decades.

Re: Keybase launches encrypted Git

#207

Post by hasenj »

Walkman wrote: post #58

I have a private repo on GitHub which contains my dotfiles with SSH private keys, tokens, secrets and all kinds of secret stuff. I was uncomfortable storing it there, but my laziness/lack of time kept it there. Finally I will be able to encrypt the entire repo, yay!!

did you delete the unencrypted repo from github? actually even if you did, a version of it might still be lurking in some corner. Maybe time to create a new set of private keys?

Re: Keybase launches encrypted Git

#208

Post by hasenj »

Wait, what exactly _is_ keybase?

The home page says:

> Keybase is a new and free security app for mobile phones and computers.

ok, so, what does it do?

> For the geeks among us: it's open source and powered by public-key cryptography.

Still have no idea what it does ..

> Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server can't leak your files or be hacked.

ok, so what is it? what does it do?

> [picture that looks like a chat app]

So it's an encrypted chat server?

What is it?

How can you have a homepage for a product that doesn't talk about what the product is and what it does?

Why so obscure? Are you trying to hide something? Is this really a home page for a product aimed at people who care about security?

Compare it to, for example, tarsnap's[0] homepage, which explains exactly what the product does and doesn't leaving you wondering about anything.

[0]: https://www.tarsnap.com/

Re: Keybase launches encrypted Git

#209

Post by mook »

ThatGeoGuy wrote: post #152
petetnt wrote: post #138

Earlier quoted context omitted.

It is.

To expand on this, you need to add the fork as an alternate remote (as opposed to origin), and then replace "origin" in the command posted prior.

I thought it was in the PR destination repository (since they are under that repository's /pull namespace). You'd need to add the alternate remote if it's a PR into a fork (as opposed to from it), no?

Re: Keybase launches encrypted Git

#210

Post by taneq »

hasenj wrote: post #208

Wait, what exactly _is_ keybase? The home page says: > Keybase is a new and free security app for mobile phones and computers. ok, so, what does it do? > For the geeks among us: it's open source and powered by public-key cryptography. Still have no idea what it does .. > Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server…

It's Jabberwocky.
Post reply on HN