Keybase 4.0
github.com
Keybase 4.0
1–10 of 26 posts
Re: Keybase 4.0
#2Still waiting for 2FA authentication (sigh) ... everyone but Keybase and my bank seems to know how important this is!
Re: Keybase 4.0
#3Still waiting for 2FA authentication (sigh) ... everyone but Keybase and my bank seems to know how important this is!
Where would you want 2FA to be added? When setting up a new device?
Re: Keybase 4.0
#4Keybase is a really cool solution to a problem (or problems?) I don't seem to have.
I've had an account for a while but don't really have any reason to use it.
Seems like they're pivoting towards being a Slack competitor. Maybe if they open sourced the server portion it could be a chat solution that OSS projects can feel okay about using.
Re: Keybase 4.0
#5Keybase is a really cool solution to a problem (or problems?) I don't seem to have. I've had an account for a while but don't really have any reason to use it. Seems like they're pivoting towards being a Slack competitor. Maybe if they open sourced the server portion it could be a chat solution that OSS projects can feel okay about using.
Keybase is a great way to do company onboarding. Have a new employee setup a Keybase account (if they don't have one already) and now you have a simple and secure way to have conversations and exchange files (e.g. W-4 forms, insurance, etc)
I use it for personal communications too, so it is nice to use the same secure messaging platform for both work and personal and switch back and forth from computer to phone easily. I do wish the server portion and apps were opensource though.
Re: Keybase 4.0
#6Still waiting for 2FA authentication (sigh) ... everyone but Keybase and my bank seems to know how important this is!
2FA is not very helpful if your service relies on encryption for everything (like keybase). It's not possible to use 2FA without another party verifying the authentication code. Keybase could include this (then they would have to verify it), but so far keybase has gone to great lengths to not actually have to hold any secrets for users. They even perform password hashing in the browser instead of on their servers. 2FA would force them to do some processing with secrets on the server side.
Having 2FA with Keybase would be similar to having 2FA with a local password safe like Keepass. Yes, you could implement 2FA. However, you would have to rely on an external service, and if people have your password and can modify the software, they can simply comment out the 2FA check and they can decrypt your password safe.
The entire security model of Keybase is based on having all data encrypted at all times. Adding 2FA would add some false sense of security, which doesn't affect the encrypted data at all.
Re: Keybase 4.0
#7did anyone figure out what the arrow on the top does?
Re: Keybase 4.0
#8Keybase is a really cool solution to a problem (or problems?) I don't seem to have. I've had an account for a while but don't really have any reason to use it. Seems like they're pivoting towards being a Slack competitor. Maybe if they open sourced the server portion it could be a chat solution that OSS projects can feel okay about using.
Like 2 years ago, Rob Pike announced Upspin to much fanfare, which is a full OSS implementation of more or less the same thing as Keybase's KBFS. Since then, I haven't heard anything else about it. I tried using it for a little bit and it worked really well. anyone around here still use it, or know it's status?
Re: Keybase 4.0
#9Uninstalled because on Windows it registers itself to auto-start on boot no matter what you do. I keep removing it from the autostart places and it keeps registering back.
I get it that they want to get usage telemetry, but it's ridiculous for a security focused app to force itself like that.
https://github.com/keybase/keybase-issues/issues/2380
Re: Keybase 4.0
#10Still waiting for 2FA authentication (sigh) ... everyone but Keybase and my bank seems to know how important this is!
2FA is not very helpful if your service relies on encryption for everything (like keybase). It's not possible to use 2FA without another party verifying the authentication code. Keybase could include this (then they would have to verify it), but so far keybase has gone to great lengths to not actually have to hold any secrets for users. They even perform password hashing in the browser instead of on their servers. 2F…
I disagree, having a single password is a risk even if all encryption is done locally.
Why not use an M-of-N / 2-of-3 encryption scheme where the user can optionally have Keybase protect one of those keys via a 2nd factor. The user would keep the 3rd in the form of a yubikey or simply written down and physically secured.
This could improve both usability and security and Keybase itself still doesn't have access to your data.