Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase launches encrypted Git

keybase.io

Post reply on HN
Print view View original

221–230 of 277 posts

Re: Keybase launches encrypted Git

#221

Post by j7ake »

jredmond wrote: post #114
j7ake wrote: post #8

Hi security newbie here, I have private bitbucket repo for storing my pass data. One problem is that pass often leaks some metadata like headers of directories. From security standpoint does this mean it is more private to host the git repo on keybase versus bitbucket ?

That depends - is that data encrypted on your system? Since git is decentralized, there's a chance that any plain-text copy (such as a clone on your system) could be compromised. Keybase even addresses this in the FAQ, to an extent: > What if my computer is compromised? > Your work is only as safe as your endpoints, so we can't help you there. This applies regardless of host or protocol, BTW, and it isn't even specif…

Hi pass uses gpg encryption on the text files my only concern are the file names which can leak meta info, for example just searching GitHub https://github.com/zurchpet/pass shows this person has passwords in a public repository but encrypted. Nevertheless I can see that the file names are credit card info and other sensitive info. It's like having a safe with a label "important stuff inside" ! Does keybase solve this problem ?

Re: Keybase launches encrypted Git

#222

Post by lucideer »

hasenj wrote: post #208

Wait, what exactly _is_ keybase? The home page says: > Keybase is a new and free security app for mobile phones and computers. ok, so, what does it do? > For the geeks among us: it's open source and powered by public-key cryptography. Still have no idea what it does .. > Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server…

My read:

It's a product that's great for some security-oriented developers but hard to sell to others conceptually.

In order to make it appealing and useful to a more general audience, they've added extras which are comparable to Dropbox and Slack, just less featured and more secure.

Which seems a good approach given their constraints.

Re: Keybase launches encrypted Git

#223

Post by sorokod »

daveheq wrote: post #217

Just wait til the government bans this because people will store kiddie porn, terrorist communications, and copyrighted media into it.

"Just wait til the government bans this because people will store kiddie porn, terrorist communications, and copyrighted media into it."

More precisely, the government will claim that ...

Re: Keybase launches encrypted Git

#224

Post by ris »

JBiserkov wrote: post #150
ris wrote: post #119

Keybase, please just support web of trust already. In some way. Not everyone I want to be able to authenticate necessarily has public social media accounts.

Do they have a website/server? #1. Host a file on your site You can host a text file, such as yoursite.com/keybase.txt. This is preferred, if you have a website. #2. Set a DNS TXT record Instead of hosting a web page, you can place a keybase proof in your DNS records.

> Do they have a website/server?

Not necessarily. I'm talking about people who want to remain anonymous (or pseudonymous) and might want to keep as low a public online profile as possible.

Re: Keybase launches encrypted Git

#225

Post by Cthulhu_ »

malgorithms wrote: post #24
eropple wrote: post #10

Earlier quoted context omitted.

So I love Keybase unconditionally and if you guys weren't rolling in physical offices (and not one in Boston) I'd have been beating down your door to come work there--I think what Keybase is doing is important and it's something I'd love to work on. But I have a serious question that maybe you can answer, and it's something everybody who I've showed this to has asked me: How is Keybase gonna make money? How am I assu…

We believe the right long-term answer for Keybase is finding a way to charge large corporations and offer pretty much everything else for free. Obviously there would have to be some paid tier if you really wanted 10TB of storage or something, but very few people want that right now. We're still just getting started. Of course to achieve our goal, we'll also have to find a way to distinguish communities - which we'll…

The enterprise would be a valid target, but if you really want them to trust you, you'll need to offer localized hosting (host from EU, Russian, Chinese datacenters) as well as on-premise hosting.

Actually, in that last one you should probably also offer consultancy to set up the servers securely - both software and physical hardware security. Secure software isn't worth much if the systems it runs on is compromised. Consultancy can be worth a lot of money, if your customers think it's worth it.

I'd start working on offering a paid enterprise solution soon tbf. I'd also tweak your landing page, the blurb is "a new and free security app"; the "new and free" doesn't instill much trust, and the "security app" doesn't really describe what it does. The second phrase tries to explain that "it's Slack" or "it's Dropbox", which I guess is fair, but I'd aim towards distancing yourself and describe it as e.g. "End-to-end encrypted communications and file sharing". What makes Keybase unique? I mean Dropbox has a pretty solid security page (https://www.dropbox.com/business/trust/security/architecture), as does Slack (https://slack.com/security).

Re: Keybase launches encrypted Git

#226

Post by AdrianRossouw »

choosegoose wrote: post #153
AdrianRossouw wrote: post #148

The two most interesting companies in crypto for me right now are KeyBase, and Wire. I kind of wish there was some way for them to interact with each other, because it feels like they each have a piece of some bigger puzzle.

Are you not concerned with the data Wire collects? https://news.ycombinator.com/item?id=14069674 Versus the data Signal collects: https://signal.org/bigbrother/eastern-virginia-grand-jury/ Although I agree Wire looks like a much more (visually) polished chat service, it seems like they (Wire) collect more data than is necessary.

Wire has open sourced it's server code (gplv3 even) and is working on federation support :

https://medium.com/@wireapp/wire-server-code-now-100-open-so...

So you can run your own copy of it, and be in complete control of any information it collects.

Re: Keybase launches encrypted Git

#227

Post by rkangel »

hasenj wrote: post #208

Wait, what exactly _is_ keybase? The home page says: > Keybase is a new and free security app for mobile phones and computers. ok, so, what does it do? > For the geeks among us: it's open source and powered by public-key cryptography. Still have no idea what it does .. > Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server…

IMO opinion, the homepage is great - it covers the headlines. What it is missing is a link to a 'features' page that provides more details on the actual services and benefits.

Fundamentally, at this time your market is the more technically minded people who are going to want something a bit more concrete than "Imagine a Slack...".

Re: Keybase launches encrypted Git

#228

Post by hannob »

lsiebert wrote: post #161
hannob wrote: post #64

Earlier quoted context omitted.

> Keybase team member here. Interesting fact: git doesn't check the validity of sha-1 hashes in your commit history. I heard this a couple of times and tried to confirm it a while ago, but was unable to. I wasn't able to forge a repository with faulty hashes in it. I also heard plenty of people tell me that there exist public repositories with wrong hashes in them, but when I asked them they never could come up with…

I may be wrong, but here's my current understanding. I believe Git CAN check the validity of sha1 hashes (I read the source a few years ago and have a very tiny git commit) using git fsck, which I believe kernel.org does nightly. It just doesn't do so automatically with every commit or whatever. But you can set up a test in your server, I believe, if that's important to you, either watching the files, or checking pus…

Sorry, you're confusing issues with a completely unrelated issue (SHA1 collissions). I haven't asked about that.

Re: Keybase launches encrypted Git

#229

Post by Natanael_L »

dheelus wrote: post #96
malgorithms wrote: post #2

Keybase team member here. Interesting fact: git doesn't check the validity of sha-1 hashes in your commit history. Meaning if someone compromises your hosted origin, they can quietly compromise your history. So even the fears about data leaks aside, this is a big win for safety. From an entrepreneurial perspective, this is my favorite thing we've done at Keybase. It pushes all the buttons: (1) it's relatively simple,…

What would I need to do to permit someone read-only, clear-text, non-public access to an encrypted repo? Can a combination of existing GIT / GitHub privileges and the Keybase solution help? If yes, and if you can add 2FA and we might be interested in becoming a customer.

Today your usecase can be solved ad-hoc by additionally manually signing what you push to keybase git, shared with the people you want to have read access.

If you want an encrypted storage solution with integrated read only access capabilities, I recommend using Tahoe-LAFS. You can probably store a git repository in it just fine.

Re: Keybase launches encrypted Git

#230

Post by dx034 »

Too wrote: post #211
Remed wrote: post #87

Earlier quoted context omitted.

Out of curiosity: why do you keep such documents in repositories instead of simply in a filesystem (on an encrypted volume, backed up and possibly synced across devices)? Tax spreadsheets usually don't change, so there's no need for version history (if anything, new rows for new years are added, but without changing past data). I ask this because I'm trying to figure out a solution for myself for keeping sensitive pe…

For me one big benefit is that it's distributed. I like to keep my important documents backed up on all the computers i have, on a USB drive stored in a safe location and also store the data with a cloud provider. Now, if i update one document on computer A, and another document using computer B, i have to sync it to all other devices which is a PITA without git. You get into the situation where you don't know if the…

Wouldn't encrypted files with a service like Dropbox help? Containers usually sync well (only syncs changed parts). Only downside is that you can't access files without decryption software.
Post reply on HN