241–250 of 751 posts
Earlier quoted context omitted.
Maybe Zoom is trying to solve that with help from Keybase?
By having my private keys?
Earlier quoted context omitted.
They don't have access to your unencrypted private key, it's just a backup of your private key which is encrypted by (hopefully) a very strong password. This feature saved my skin on one occasion.
I believe the argument is that a private key encrypted with a password is not cryptographically different from a plaintext private key. The password is more of a "keeping honest people honest" kind of thing, than true security. If it was truly secure, then you'd be using a new private key to encrypt your real private key, and then you're back to where you started. Cryptography is hard, which is why I was such a big f…
It is different. Keybase could update the app to steal your key, but that’s a visible attack that can’t be done retroactively.
> If it was truly secure, then you'd be using a new private key to encrypt your real private key
There’s no reason to use asymmetric crypto for symmetric encryption.
Earlier quoted context omitted.
It bothers me that they even tried, honestly. Keybase seems like something that should be small, isolated, FOSS, supported by a foundation, etc. They could have built a business _around_ Keybase I'd imagine, but all they managed to do with this is invalidate Keybase and make people like myself, who feared their business motivations, feel vindicated for being paranoid. I'll never blame anyone for wanting to make money…
As someone who works at an open-source-focused business, I respectfully disagree. Unlike proprietary software, open source software doesn't depend on the broken window fallacy. As a result, it's really hard to make open source profitable. There's lots of different avenues to get there, and I don't like to fault someone for their efforts if the bulk of their work goes towards improving open source software, as I think…
> It is not seen that as our shopkeeper has spent six francs upon one thing, he cannot spend them upon another. It is not seen that if he had not had a window to replace, he would, perhaps, have replaced his old shoes, or added another book to his library. In short, he would have employed his six francs in some way, which this accident has prevented.[1]
Capitalism is about acquiring capital, i.e. money. There's no such evidence that people with money actually spend it in ways other than investment, and the sole purpose of that isn't to donate to companies that need it, it's to profit off it and essentially hoard more capital. Sure, poor people with either very little or no capital spend that capital on necessities, and thus drive the economy, but there's no evidence that people with large amounts of capital spend that on anything at all, there's more evidence that they hoard it and seek only to acquire more capital. The entire system is built to favour those people.
Keybase' post about the acquisition: https://keybase.io/blog/keybase-joins-zoom > What the Keybase team will be doing > Initially, our single top priority is helping to make Zoom even more secure. There are no specific plans for the Keybase app yet. Ultimately Keybase's future is in Zoom's hands, and we'll see where that takes us. Of course, if anything changes about Keybase’s availability, our users will get plenty…
> So, yup, keybase is dead. Well, shit. Keybase had an amazing potential. I use it every day to ad-hoc securely share/store stuff. It will be sad to see it wither even more than it has. :(
Keybase' post about the acquisition: https://keybase.io/blog/keybase-joins-zoom > What the Keybase team will be doing > Initially, our single top priority is helping to make Zoom even more secure. There are no specific plans for the Keybase app yet. Ultimately Keybase's future is in Zoom's hands, and we'll see where that takes us. Of course, if anything changes about Keybase’s availability, our users will get plenty…
Wow, this means that keybase stuff thinks that Zoom is secure already. Zoom should have hired people who don't think that way.
Earlier quoted context omitted.
I was about to complain about your desktop Electron app but it seems that spectral[0] is already usable without any hassle (build from source, ...) at least on Fedora, time to reactivate my Matrix account, keep up with the great work 0: https://gitlab.com/spectral-im/spectral
There's also Fractal[0] which uses GTK+ instead of Qt, and is maintained by the Gnome foundation and planned to be used by the Librem 5 AFAIK. [0]: https://matrix.org/docs/projects/client/fractal
Earlier quoted context omitted.
They don't have access to your unencrypted private key, it's just a backup of your private key which is encrypted by (hopefully) a very strong password. This feature saved my skin on one occasion.
I believe the argument is that a private key encrypted with a password is not cryptographically different from a plaintext private key. The password is more of a "keeping honest people honest" kind of thing, than true security. If it was truly secure, then you'd be using a new private key to encrypt your real private key, and then you're back to where you started. Cryptography is hard, which is why I was such a big f…
> I believe the argument is that a private key encrypted with a password is not cryptographically different from a plaintext private key.
You have it backwards. On principle an encrypted anything (key in this case) is of zero value to anyone. It does’t matter if you tweet encrypted messages every 30 seconds to millions of followers or not: they're encrypted.
When you use a password to encrypt, and you (or your client/agent) selects an appropriately sophisticated suite, you end up seeding a KDF with your password and then using the resulting data as the actual “private key” (its just a symmetric key, no public/private). If your password has enough entropy, then the resulting key is perfectly secure.
In practice people are paranoid. “If the key is on Keybase’s servers, someone could get it and brute force decrypt it.” It’s almost pop culture fallacious, though, because if you believe someone can do that, then they can just as easily brute force the actual key. In practice people use shitty passwords, and crypto weakens as time moves forward, there are good and bad algorithms, and the whole point of a public key infrastructure is to keep private keys off the wire. So it’s generally seen as bad form to copy private keys around, even if they're encrypted. We’re still pretty far on the spectrum here because if your crypto breaks you have to rey key everything anyway. Not just re-encrypt unchanged private keys.
At the end of the day you're either copying a private key around or you aren't. And you should probably avoid situations where you need to do that because there are better ways to PKI. If your threat model can tolerate encrypted key backups and key sharing, then go for it. But that should be something you control.
It's kinda ironic that Keybase disappears into Zoom the day after Matrix/Riot enabled end-to-end encryption by default, with cross-signed device verification similar to Keybase's concept of connected keys - see https://blog.riot.im/e2e-encryption-by-default-cross-signing... . In other words, a fully open source (and open standardised) alternative continues to exist in the form of Matrix. [disclaimer: project lead for…
I've been looking into Matrix as a "personal IM bridge" and I'm thinking this could be a way for Matrix to get traction. Let's say you're in a position that I think may here are: You would prefer to use IM in a secure way. Let me qualify "secure" for this purpose meaning: Encryption of communication in rest and transit; not relying on a single infra/network/service provider; being able to communicate with new peers e…
On the other hand, bridges are always an impedance mismatch - you have to keep up with new features on both side of the bridge, and the system you're bridging into doesn't always want to be bridged.
So, we think bridges are a key thing for Matrix (it's where the name comes from - matrixing together different comms platforms!) - but it'd be wrong to predicate the success of the protocol on bridges. They're useful, they have their place, but they're not the sole reason to use Matrix.