Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase’s browser extension subverts its encryption

palant.de

Post reply on HN
Print view View original

71–79 of 79 posts

Re: Keybase’s browser extension subverts its encryption

#71

Post by danenania »

FabHK wrote: post #66
Leace wrote: post #14

Earlier quoted context omitted.

When they started asking me for my private key and claiming it'll be secure because it's "encrypted" that raised a red flag for me. Then I found out that they're not using popular and audited libraries like OpenPGPjs instead... writing their own!

Filippo Valsorda had a blog post on uploading his private key (back in 2014) in which he actually publicly uploaded his private key - encrypted, that is, as it is uploaded to Keybase [1]. Of course, it goes against orthodoxy to share/upload your private key, but I'm not sure I've ever seen a good rebuttal to Filippo's post. It seems to me though that you're reducing the entropy of your key from the 2048 bits or whate…

If you encrypt a private key with a secret passphrase, then upload the encrypted private key somewhere, the passphrase is essentially your new private key. As long as the passphrase has sufficient entropy, there's no meaningful drop in security with this approach.

Re: Keybase’s browser extension subverts its encryption

#72

Post by Leace »

FabHK wrote: post #66
Leace wrote: post #14

Earlier quoted context omitted.

When they started asking me for my private key and claiming it'll be secure because it's "encrypted" that raised a red flag for me. Then I found out that they're not using popular and audited libraries like OpenPGPjs instead... writing their own!

Filippo Valsorda had a blog post on uploading his private key (back in 2014) in which he actually publicly uploaded his private key - encrypted, that is, as it is uploaded to Keybase [1]. Of course, it goes against orthodoxy to share/upload your private key, but I'm not sure I've ever seen a good rebuttal to Filippo's post. It seems to me though that you're reducing the entropy of your key from the 2048 bits or whate…

I wouldn't have an issue with that if it was a private subkey. You could easily revoke it and replace it in case Keybase does something weird. But giving them private keys for master/primary key is not exactly sensible.

For the record I don't have a private master key in any online connected devices. GnuPG works well in an air-gapped scenarios. Does Keybase client? Or does it require constant phoning home?

Re: Keybase’s browser extension subverts its encryption

#73

Post by Leace »

lrvick wrote: post #55
nickik wrote: post #20

Earlier quoted context omitted.

They don't throw everything on the blockchain for no reason. They specifically back up the root of the merkel tree into the blockchain. Honestly, the OpenPGP world has so competently failed at usability and is only adopted by the most hard core of nerds. Even I have stopped using it for the most part. And that it is two steps back in security overall is just not true. Maybe in some individual features that you care a…

We already have a distributed backup system: the keyserver network. There are also efforts like DANE to put it in DNS. They however refuse to sync with it. They only sync with their own proprietary servers using their own protocol. Also there are projects in the OpenPGP world making very easy to use workflows and interfaces without centralizing or breaking standards. OpenKeychain for android is a fantastic example of…

> There are also efforts like DANE to put it in DNS.

It seems GnuPG and "the ecosystem" is slowly moving to WKD (Web Key Directory) as it is easier to deploy (e.g. kernel.org is using it).

If you put your binary key (gpg --export 36C8AAA9) at https://lrvick.net/.well-known/openpgpkey/hu/gfoh5t79df9raqt... tools would retrieve it automatically when using your e-mail address (gpg --locate-key $EMAIL). (I got the hash by running gpg -k --with-wkd 36C8AAA9).

This is supported by GnuPG, OpenKeychain and some e-mail clients: Enigmail, GpgOL (Outlook) would fetch your key in background when someone is writing an e-mail.

For details see: https://wiki.gnupg.org/WKD#Implementations

The spec: https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-s...

Re: Keybase’s browser extension subverts its encryption

#74

Post by palant »

throwanem wrote: post #50

This isn't a hard bug to avoid, but it would take completely reimplementing the extension so that all of its UI beyond the "keybase chat" button lives in the extension rather than being injected into the page, and having the chat button do nothing but call the extension with the username of the intended recipient. I understand why Keybase principals don't want to do that, because the extension is an addon that probab…

Security bugs don't live on GitHub, they are on HackerOne. It is up to the vendor whether to make them visible. This particular one is still hidden, probably because I have code there demonstrating how this issue could be exploited.

Re: Keybase’s browser extension subverts its encryption

#75

Post by lrvick »

Shank wrote: post #40
lrvick wrote: post #15

Earlier quoted context omitted.

Honest question: what makes you think they have -ever- done crypto right? As best I can tell they have rolled their own mostly closed source crypto solution from day 1.

TripleSec is open source and they’re basically doing a reference implementation from Applied Cryptography. You can see the details here: https://keybase.io/triplesec

This is a perfect example of them doing it wrong.

Modern cryptographic algorithims rarely get broken, but keys get stolen by malware all the time. Instead of moving the keys out of system memory and thus out of reach of malware they just add layers of obfuscation to a key that is going to be decrypted into system memory. Mixing unrelated strong ciphers is likely to yeild nothing but a false sense of security at best and yeild malleability attacks at worst.

If you take your key and encrypt it 3 times, or 200 times, it is still moot if it by design it ends up plaintext in system memory.

You don't see anyone else doing this sort of nonsense mix and match security for a reason. Their threat profile is fundimentally broken if they think attacks on modern crypto primitives are more likely than malware on an end users system.

Re: Keybase’s browser extension subverts its encryption

#76

Post by jsjohnst »

daveFNbuck wrote: post #69
jsjohnst wrote: post #26

Earlier quoted context omitted.

None of these bullets are “open and shut cases”, but all are related without needing a major leap, especially the first one. * Content spoofing / text injection * Issues related to software or protocols not under Keybase control * Reports of spam * Vulnerabilities affecting users of outdated or unpatched browsers and platforms Do I agree with their (alleged) actions? NO! But as I know several folks at Keybase persona…

If this vulnerability can fit those 4 categories, what kind of vulnerability would you be confident would qualify for the bounty?

That’s the problem, I feel their exclusions from bounty are too wide. This vulnerability if confirmed should be eligible for some bounty imho. That said, they published the exclusions publicly, so getting butt hurt over not getting paid when they said you wouldn’t feels a bit petty to me.

Re: Keybase’s browser extension subverts its encryption

#77

Post by daveFNbuck »

jsjohnst wrote: post #76
daveFNbuck wrote: post #69

Earlier quoted context omitted.

If this vulnerability can fit those 4 categories, what kind of vulnerability would you be confident would qualify for the bounty?

That’s the problem, I feel their exclusions from bounty are too wide. This vulnerability if confirmed should be eligible for some bounty imho. That said, they published the exclusions publicly, so getting butt hurt over not getting paid when they said you wouldn’t feels a bit petty to me.

Why do you say he's butt hurt? He doesn't even mention not getting paid. The post is about Keybase not taking a security vulnerability seriously. Is it petty to warn people about an insecure product?

Re: Keybase’s browser extension subverts its encryption

#78

Post by jsjohnst »

daveFNbuck wrote: post #77
jsjohnst wrote: post #76

Earlier quoted context omitted.

That’s the problem, I feel their exclusions from bounty are too wide. This vulnerability if confirmed should be eligible for some bounty imho. That said, they published the exclusions publicly, so getting butt hurt over not getting paid when they said you wouldn’t feels a bit petty to me.

Why do you say he's butt hurt? He doesn't even mention not getting paid. The post is about Keybase not taking a security vulnerability seriously. Is it petty to warn people about an insecure product?

> Why do you say he's butt hurt?

I didn’t. It was a generalized statement about the bounty terms, not directed at any one person.

Re: Keybase’s browser extension subverts its encryption

#79

Post by FabHK »

jwilk wrote: post #67
FabHK wrote: post #66

Earlier quoted context omitted.

Filippo Valsorda had a blog post on uploading his private key (back in 2014) in which he actually publicly uploaded his private key - encrypted, that is, as it is uploaded to Keybase [1]. Of course, it goes against orthodoxy to share/upload your private key, but I'm not sure I've ever seen a good rebuttal to Filippo's post. It seems to me though that you're reducing the entropy of your key from the 2048 bits or whate…

Security strength of RSA is much lower than the key size. 2048-bit RSA gives you only ~112 bits of security.

That's very informative, thanks. So indeed, with a good passphrase the drop in security is minimal.
Post reply on HN