Do they have any sort of monetization plan or strategy?
Yes, see the blog post ..?
Ah, thanks I didn't make it that far
Keybase raises $10.8M
101–110 of 126 posts
Re: Keybase raises $10.8M
#102Doesn't this just set up a central failure point? Does Keybase have a forward secure key system?
Re: Keybase raises $10.8M
#103Can someone please send a Keybase invitation to: keybase-please@Safe-mail.net This help would be appreciated.
Just sent you an invite. If anyone else needs an invitation, I still have 8 left. Shoot me an email or reply here if you want one. Edit: 6 still left.
Please? tanderson@exherbo.org
Re: Keybase raises $10.8M
#104Keybase is the wrong way to do a PKI directory. First, people should have multiple keys/identities by default; multiple identities should be the normal thing everyone does. Single identities will be used by governments to control people. They'll also work against normal communication patterns where people speak differently to different groups (think parents, friends, coworkers.) Second, matching a name with social me…
You laid out a number of points there, and I think some of them are indicative of what's really holding back security for the masses. "Matching a name with a social media is the wrong way to lookup others" -- this is the one I take greatest issue with, because it's the way we know people now. All the people I collaborate with online now, I know them by those exact names. Coworkers, remote collaborators, friends on in…
To use your example, your brother posts a message on Twitter and you don't know your brothers Twitter username. If you're confident that it's your brother posting, then there's no problem. If you're uncertain that it's your brother, Keybase will let you verify it's him -- but that's a problem. Imagine a political dissident living in a dictatorship and it's the government who uses Keybase to match a Twitter username to a Facebook account.
We don't want accounts tied together. People need multiple identities online.
How do you get a persons key, and how do you know it's the right key? I think the answer will work like email addresses do now: someone will tell you a little info (name + hash@org) and you'll lookup their key.[0] Then you'll verify it as appropriate to the situation. That kind of system would allow and encourage multiple identities, and doesn't encourage posting PII.
To "bring public key crypto to everyone" you don't need to build this kind of directory (where you verify accounts.) You can instead get companies to participate in a PKI that they control (like they control email, DNS, http, etc..) and then they'll integrate it into existing software, provide it to users, experiment with UX and client designs, etc... Making an open source, server-side solution lets you turn 'Sign in with Facebook' into an ally that not only gets Facebook to provide keys and integrate crypto, but invest in servers and software.
Last, many people share a sentiment that a private key shouldn't leave our computers or phones (or fobs) to be managed by others. It's a reasonable attitude, but I think getting "crypto to everyone" and widely implemented is more important, and a managed system today doesn't preclude unmanaged keys in the future.
[0] To expand on this example: I'm irq-1 ff38a9@keys.news.ycombinator.com, and at work I'm Alice 23ff45@work. If you lookup hash@org and find a string that looks right (a username or real name) then you get their public key. You have some confidence it's the right person, and are free to verify it further with any other means.
Re: Keybase raises $10.8M
#105Awesome! I hope some of this $ will help to shorten the waiting list queue...
I have 8 invites if someone wants one...
Re: Keybase raises $10.8M
#106Earlier quoted context omitted.
You laid out a number of points there, and I think some of them are indicative of what's really holding back security for the masses. "Matching a name with a social media is the wrong way to lookup others" -- this is the one I take greatest issue with, because it's the way we know people now. All the people I collaborate with online now, I know them by those exact names. Coworkers, remote collaborators, friends on in…
To use your example, your brother posts a message on Twitter and you don't know your brothers Twitter username. If you're confident that it's your brother posting, then there's no problem. If you're uncertain that it's your brother, Keybase will let you verify it's him -- but that's a problem. Imagine a political dissident living in a dictatorship and it's the government who uses Keybase to match a Twitter username t…
I am with you 110% that people need to be able to have multiple identities online that are not linkable. That does not mean they should not be able to link multiple accounts to a single identity.
That is to say, "one identity per person" is wrong; "one identity per account" is also wrong. Both of these in the sense that they should be permitted if that is what the person desires but should not be expected or (especially) enforced.
Re: Keybase raises $10.8M
#107Wonder just how secure the @keybase.io email part of this is going to work? Would you have to load this email into a client or would you just pull down the email in Node?
Thoughts anyone?
Re: Keybase raises $10.8M
#108I just looked at the source of the page: A) external CSS which might leak about a visitor to Google B) No Google Analytics or other 3rd party hosted script tags on Keybase. And this has the added bonus that we'll never be able to serve ad code. \o/ \o/ chris max ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--> No 3rd party JS: good. Still leaking visitor info: bad.
hah, I forgot about that note. Good point - our stance was to protect from targeted code injections (by a coerced or hacked Google). But of course you're right, there's no point letting Google know at all. I've made an issue to move font/css hosting off Google.
You might also consider setting Content-Security-Policy headers to enforce your intent. http://content-security-policy.com/
Re: Keybase raises $10.8M
#109This could help solve the personal identity verification issues associated with smart contracts and such. This is one of the key problems with the Ethereum project too.
Re: Keybase raises $10.8M
#110Earlier quoted context omitted.
Oh, a clarification: the Node client will be replaced by the Go version. The `keybase` command line app will be a superset of what's available in the Node client now. Sorry. So yeah - still providing those API's. PGP support will continue, always, it's just that you won't need to have PGP on all your devices -- just the ones you use PGP on. Your PGP key will be part of a family of keys you're known by. If you install…
It's about time for your obligatory /r/golang post about how you switched from 30 servers to 1 by switching to Go ;)
It's client-side code they're migrating rather than server-side.
Fingers crossed it makes the CLI a bit snappier!