Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase.io

keybase.io

Post reply on HN
Print view View original

11–20 of 125 posts

Re: Keybase.io

#11

Post by JustARandomGuy »

malgorithms wrote: post #8

Hi everyone, Chris here, I've been working with Max on Keybase. I can't help but feel this ended up scooped a bit early. (Crap!) Not a surprise, because HN is quick. The alpha site's changing every day, and we're working on the documentation now. I don't use the term "alpha" loosely. There will be extensive security details published, explaining every aspect of the identity proof system, client sessions, etc. They wi…

Hi Chris, a few comments:

1. I like the site design, the story flow on the front page does a great job of explaining what keybase is.

2. I see (from the abovementioned story flow) that keys can be verified by reviewing signed tweets/gists. Is this functionality extendable to arbitrary links; i.e. verifying keys against personal blogs, Tumblr, WordPress or does the third-party site need to implement a recognized API?

Again, thanks so much, and it looks like a terrific site so far.

Re: Keybase.io

#14

Post by rch »

Sir_Cmpwn wrote: post #3

Styles are broken on Firefox, text is flowing off the right side of the screen. Why do lots of sites seem to have forgotten about testing on Firefox recently?

The whole thing seems to be very early alpha. I'm sure that will be taken care of a little further down the road.

As a former Opera user, I certainly sympathize though.

Re: Keybase.io

#15

Post by 8_hours_ago »

Sir_Cmpwn wrote: post #3

Styles are broken on Firefox, text is flowing off the right side of the screen. Why do lots of sites seem to have forgotten about testing on Firefox recently?

It has the same text flow issue with Chromium so I'm guessing that they didn't do much testing at all. Furthermore, using a narrow window results in absolutely no information on the front page except "Join" and "Login" links.

For reference, I'm using Firefox 25.0.1 and Chromium 30.0.1599.11 in Linux.

Re: Keybase.io

#16

Post by addisonj »

Looks very cool, but one piece of feedback: Let the user know it is in invite-only beta on the homepage.

I downloaded the command line util and tried to login, only to be let down :(

Excited to try it out!

Re: Keybase.io

#17

Post by Stealth- »

This is great. Proper cryptography is the solution to so many of the problems the modern internet is facing right now, but the key problem with cryptography is that it is never user friendly enough and never distributed enough.

This looks like a great step in the right direction.

Re: Keybase.io

#19

Post by rinon »

Very cool idea. The idea of automatically verifying public keys over publicly accessible and known channels is great. This is more or less the manual process I follow when I want to verify a key remotely. Looking forward to seeing where this goes!

Also, being able to use this with arbitrary crypto software (eg GPG) would be even better!

Re: Keybase.io

#20

Post by malgorithms »

JustARandomGuy wrote: post #11
malgorithms wrote: post #8

Hi everyone, Chris here, I've been working with Max on Keybase. I can't help but feel this ended up scooped a bit early. (Crap!) Not a surprise, because HN is quick. The alpha site's changing every day, and we're working on the documentation now. I don't use the term "alpha" loosely. There will be extensive security details published, explaining every aspect of the identity proof system, client sessions, etc. They wi…

Hi Chris, a few comments: 1. I like the site design, the story flow on the front page does a great job of explaining what keybase is. 2. I see (from the abovementioned story flow) that keys can be verified by reviewing signed tweets/gists. Is this functionality extendable to arbitrary links; i.e. verifying keys against personal blogs, Tumblr, WordPress or does the third-party site need to implement a recognized API?…

Good question! There will be no such thing as a general check, because -- for any identity -- the client software has to perform a check that a human would agree means something. For example, what does it mean that you own a certain blog? How would a person confirm it? Well, at first glance it might mean that you have the power to post a message there. But someone else could do that it in a comment, and so that wouldn't work with Keybase. So any given identity check has to match some human definition of what it means to have that identity. And it has to be publicly auditable.

With twitter, it's the ability to post a tweet under a certain username. With owning a tumblr account, it might be something similar. With your known StackExchange profile it might mean posting a statement in a specific part of your profile. And so on.

The common thread in each case is (1) that you post in a place where only your identity can, and (2) what you post is a signed statement claiming a connection among three things: (a) your keybase username, (b) your public key, and (3) the identity on that third party service. (The third one is necessary so it can't be moved elsewhere.) Note how twitter and github's are totally different, but achieving these three things.

We will build out this list of identity checks, hopefully making all kinds of them easy to do. Everything from proving you own a domain to having a tumblr or reddit accoun. The definition of those checks will all be publicly reviewable, both in the spec and in the client, which is what checks them for you.

Post reply on HN