Live data from Hacker News

Keybase Exploding Messages

keybase.io

11–20 of 155 posts

Re: Keybase Exploding Messages

#11
post #6
post #2

anyone care to expand on the practical applications/implications/threat model where this makes sense?

It works as long as no one takes a screenshot.

Or even extract the text + signature before it "explodes". Keybase messages don't have repudiability so anybody who has received a sign message should be considered to always have that message.

Re: Keybase Exploding Messages

#13
Exploding messages are a stupid gimmick that does not hold up to any nontrivial threat model. What's out there is out there. Clients programmed to throw away plain- and ciphertext can simply be modified to keep them. Is the intersection of the set of clueless fools and set of people who want to use strong encrypted chats really this large??

Re: Keybase Exploding Messages

#16
This is like snapchat, they're offering something that they can't actually guarantee. Of course keybase users are going to be generally more knowledgeable than snapchat users and most will understand the limitations.

Re: Keybase Exploding Messages

#18
Consider this:

  I send an exploding message, set for 1 day, to Bob.

  Bob checks his chat a week from now.

  Does Bob get the message? Or has it already exploded?
I guess I'm asking when the actual explosion timer starts - when the message is sent, or when it is read? For group messages, do all parties need to read it before the timer starts?

Re: Keybase Exploding Messages

#19

Consider this: I send an exploding message, set for 1 day, to Bob. Bob checks his chat a week from now. Does Bob get the message? Or has it already exploded? I guess I'm asking when the actual explosion timer starts - when the message is sent, or when it is read? For group messages, do all parties need to read it before the timer starts?

From the FAQ:

Does the timer begin when the message is sent or received?

Sent.

This seems like the only sensible answer for group chats. And we can't have a different answer for 1-on-1 chats and group chats. That would confuse people. Not the kind of person who reads an FAQ such as yourself, of course.

So our answer is simple: you set a timer and the message is gone after that time.

Re: Keybase Exploding Messages

#20
post #9
post #4

As I understand, Keybase chat is open-source? ( https://github.com/keybase/client ) I don't have time to read through the code right now, but I'd love to hear how they implemented exploding messages with untrustworthy clients. I've thought about it a few times before, and it seems one of the few places that closed software has an advantage - You can't easily force third-party clients to delete messages. If they've so…

It is impossible to implement this feature "safely" even with trusted clients -- worst case I take a screenshot or even a photograph of the device displaying the message before it explodes. If you don't trust the person at the other end, this is never going to work. It's more useful for "we both agree that we don't want a paper trail" kind of thing.

A dead simple way to thwart the “screenshot” attack is to release a tool for accurately falsifying a screenshot. I’ve never seen this employed in practice though.
Post reply on HN