Zoom Acquires Keybase • Hacker News Board

Re: Zoom Acquires Keybase

#571

Post by WorldMaker » Thu, May 07, 2020, 9:45 PM UTC

OJFord wrote: post #321

neltnerb wrote: post #251

Earlier quoted context omitted.

I signed up so long ago that I'm not quite sure what you mean. I remember posting a bunch of public keys (like on my profile here). I think the keybase app generated them along with a private key but it has been like three years. I don't remember at all uploading one or where to find it if I did, can you explain the issue you have in mind a little more?

You can optionally have Keybase (generate and) store your private key for you. It's designed to lower the barrier to entry, but is obviously less secure than managing it yourself outside of Keybase (e.g. in GPG keyring, or a physical OpenPGP smartcard such as a Yubikey) - and some consequently wish the storage had never even been offered.

That optional GPG/PGP private key storage was also re-hidden (and almost but not quite removed) functionality by Keybase over the course of the application's life as they moved away from using traditional GPG/PGP-style keys to a more complicated but more secure system based on device-specific keys (and chains/webs of those keys and their derivatives), around when you needed another device to onboard the next device rather than just needing to sign in with username/password.

Re: Zoom Acquires Keybase

#572

Post by WorldMaker » Thu, May 07, 2020, 9:51 PM UTC

yarrel wrote: post #368

tobyjsullivan wrote: post #271

Earlier quoted context omitted.

It was actually a really nice stellar wallet implementation. A bad bet perhaps, in hindsight. Unfortunately, this acquisition means I won’t be using it anymore for the foreseeable future.

It looked like a de-anonymization attack and brought phishing attacks to crypto groups using Keybase group chat. It was badly implemented, badly introduced, and harmful for both users and adoption of the platform.

Keybase was always a de-anonymization platform, and there have always been spam/phishing concerns for the platform. The crypto wallet was a dumb way to force them to address some of the spam/phishing/harassment issues inherent in the platform as a "social media" with ties to nearly every other social media through its validation checks, but it was past time needed for spam/phishing/harassment control (as some minorities had said for years prior to the crypto wallet forcing such things).

Re: Zoom Acquires Keybase

#573

Post by efreak » Thu, May 07, 2020, 9:55 PM UTC

maximente wrote: post #307

rvz wrote: post #20

Looks like it wasn't a good idea to leave your private keys in Keybase's servers was it? Perhaps the moment that Keybase took VC funding a while back, it was over to begin with and the principles of being a "Slack competitor" and respecting their users privacy went straight out of the window and into the bin. I really had high hopes for Keybase as a Slack competitor, the cryptocurrency stuff I actively ignored, but t…

honestly the real security fail in keybase seemed to be users flocking to add every single social media identity to their keybase account, allowing anyone using the public API to remove all doubt that greg1234 on twitter == karl5912 on reddit == john1005 on HN, etc. scrape all those social media posts, reddit subs, etc. and you've probably got a solid idea of who that user is. all under the guise of public FLOSS stuf…

Or you can just use keybase to only add your accounts that already have the same username and leave the others disconnected.

Re: Zoom Acquires Keybase

#574

Post by wharfjumper » Thu, May 07, 2020, 10:01 PM UTC

I would participate in (and could provide resources to) the creation of an open foundation that had as one of its goals the writing of an open source keybase API[0] compatible server.

If anyone else is interested, please contact me directly (email in my profile).

[0]https://keybase.io/docs/api/1.0

Re: Zoom Acquires Keybase

#575

Post by andoriyu » Thu, May 07, 2020, 10:01 PM UTC

aaomidi wrote: post #377

bgee wrote: post #358

Earlier quoted context omitted.

> communication company that has its entire dev team in China citation needed Also, what are you trying to imply by this assertion?

China is a country with even less oversight than the US. For a company that does security that's concerning.

Not even that. All encrypted traffic in china needs to be decryptable by CCP. Which means if your call in zoom was routed to one of their China servers, then CCP has access to it.

That is on top of the fact that Zoom encryption is weak af.

Re: Zoom Acquires Keybase

#576

Post by remarkEon » Thu, May 07, 2020, 10:01 PM UTC

Gasp0de wrote: post #553

gonehome wrote: post #369

Earlier quoted context omitted.

"Zoom is based in California’s Silicon Valley, but it owns three companies in China that develop its software. The Citizen Lab said the structure allowed the company to lower its development costs, but added “this arrangement may make Zoom responsive to pressure from Chinese authorities.”" https://www.theguardian.com/uk-news/2020/apr/24/uk-governmen... The implication is that China is hostile and leverages their powe…

Isn't the US actually at least as bad if not worse? Thanks to Edward Snowden we know without speculation that the US "is hostile and leverages their power to censor/collect communication information from companies and their people without checks on this power" (ok, supposedly there is secret judges that secretly check on this power, but that doesn't really do any good does it?). The USA also "pressure companies to ha…

The difference is that in the US we actually get to find out about these abuses.

Re: Zoom Acquires Keybase

#577

Post by windthrown » Thu, May 07, 2020, 10:06 PM UTC

bigbob2 wrote: post #546

momokoko wrote: post #98

Earlier quoted context omitted.

They aren’t. They are making a lot of money which is what the business was made for. The post is actually refreshingly honest that keybase is now abandoned and will probably die at some point. The idea that companies were stupid enough to place their internal identity on some random 3rd party is so incredibly stupid that it’s hard to feel too bad for anyone. Congrats Keybase!

Unless I imagined it, they previously said publicly that they were unlikely to pursue a sell like this because they had succeeded at previous companies and cared more about the impact this product could make than the profit they could make from selling it. I based my decision to agree to the terms of Keybase around this statement which I can conveniently no longer find. I suspect it was in one of their airdrop announ…

You are referring to this Github Issue: https://github.com/keybase/keybase-issues/issues/788

"Yes, we sold our previous 2 businesses. But I want to point out that (1) neither of those sales ever hurt (and arguably both sales greatly helped) our users, (2) Keybase deserves special consideration which we are aware of, and (3) both Max and I are happy in a world where we never try to sell a company again, and only build things we like."

I feel silly for falling for it too. Even very wealthy people enjoy extra money.

Re: Zoom Acquires Keybase

#578

Post by patmorgan23 » Thu, May 07, 2020, 10:12 PM UTC

Gasp0de wrote: post #553

gonehome wrote: post #369

Earlier quoted context omitted.

"Zoom is based in California’s Silicon Valley, but it owns three companies in China that develop its software. The Citizen Lab said the structure allowed the company to lower its development costs, but added “this arrangement may make Zoom responsive to pressure from Chinese authorities.”" https://www.theguardian.com/uk-news/2020/apr/24/uk-governmen... The implication is that China is hostile and leverages their powe…

Isn't the US actually at least as bad if not worse? Thanks to Edward Snowden we know without speculation that the US "is hostile and leverages their power to censor/collect communication information from companies and their people without checks on this power" (ok, supposedly there is secret judges that secretly check on this power, but that doesn't really do any good does it?). The USA also "pressure companies to ha…

People don't get disappeared for actively disagreeing with the government.

Re: Zoom Acquires Keybase

#579

Post by tabbott » Thu, May 07, 2020, 10:16 PM UTC

gonehome wrote: post #550

tabbott wrote: post #523

Earlier quoted context omitted.

Losing their independence was from the beginning the most likely outcome of building something that's hard to monetize like Keybase on the VC funding model. FWIW, I doubt Keybase offering a paid plan would have raised revenue that's significant compared to their burn, so Chris was probably right to not spend resources figuring out a paid offering. For raising their next round, having $5K in revenue from a paid plan f…

How much power do the VCs typically have? Don't founders often have the ability to overrule and make their own decisions? Chris is already financially independent from the OKCupid sale, he could have open sourced the server code and/or reduced the overall burn to pivot to paid accounts. Though the weird Stellar wallet addition implied some vision/product issues anyway. Of course it's easy and probably unfair for me t…

> How much power do the VCs typically have?

I think it's less about the power relationship, exactly, and more about the way VC-funded companies are setup to be run. As part of raising a round, you prepare a business plan that involves aggressively spending the money over a couple years. You're committed both internally and to your board to execute that plan, and it's cognitively difficult to do something different as there's social pressure to do so (and one of your VC's greatest sources of power over you is they're the reference for your next fundraising round).

The result is that your company has planned to run out of money with potentially a multi-million dollar annual burn rate in two years. If as those two years are approaching, the company and/or market situation don't support raising more capital and the company isn't close to profitable, the momentum of that burn rate applies a great deal of pressure for a sale, destructive layoff, or total change in goals to "anything that improves the bottom line".

Also, the search for a story to help raise your next round can have a big effect on companies -- my view is most of Dropbox's problems when I was there (2012-2014) resulted from the search for a totally new business bigger than Dropbox Business that could justify a bigger valuation than $10B starving more obvious investments (Carousel, the now-dead photo sharing app, at one point had ~10x the engineering resources of Dropbox Business).

> Reading about Zulip - didn't you get bought by Dropbox before being open source? Is your current situation a lucky outcome - or was it a condition of the sale?

It's an extremely lucky outcome. There's a combination of factor that made this possible:

* Dropbox leadership prioritized doing the right thing by their users, and so we were able to get permission from both leadership and legal. I'm sure my personal position as a leader at the company who had a personal relationship with the people who had approve it made a difference (Though Luke Faraone made a big difference by asking legal if we could and inviting me to the meeting!). But I think Dropbox deserves a lot of credit, because they spend significant time from expensive resources (legal, etc.) making this happen, and I don't know of many companies that would ever do that. * Our users were big fans, enough so that 10 of them flew to Dropbox HQ for a week to help us do the technical work required to do an open source release with all 10,000 commits of history intact and with a scripted installation process. This was essential to Zulip being usable after that release.

https://zulipchat.com/history/ has a bit more background on the early history (though it's a bit out of date).

Re: Zoom Acquires Keybase

#580

Post by gonehome » Thu, May 07, 2020, 10:21 PM UTC

tabbott wrote: post #579

gonehome wrote: post #550

Earlier quoted context omitted.

How much power do the VCs typically have? Don't founders often have the ability to overrule and make their own decisions? Chris is already financially independent from the OKCupid sale, he could have open sourced the server code and/or reduced the overall burn to pivot to paid accounts. Though the weird Stellar wallet addition implied some vision/product issues anyway. Of course it's easy and probably unfair for me t…

> How much power do the VCs typically have? I think it's less about the power relationship, exactly, and more about the way VC-funded companies are setup to be run. As part of raising a round, you prepare a business plan that involves aggressively spending the money over a couple years. You're committed both internally and to your board to execute that plan, and it's cognitively difficult to do something different as…

Thank you - I really appreciate the detailed answer.

I think I have a better understanding of how the incentives to cooperate would be hard to overcome even if you technically have the power as a founder (and even if you’re already financially independent).

The personal experience was also interesting - thanks!