Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase.io

keybase.io

Post reply on HN
Print view View original

101–110 of 125 posts

Re: Keybase.io

#101

Post by malgorithms »

riquito wrote: post #84
malgorithms wrote: post #8

Hi everyone, Chris here, I've been working with Max on Keybase. I can't help but feel this ended up scooped a bit early. (Crap!) Not a surprise, because HN is quick. The alpha site's changing every day, and we're working on the documentation now. I don't use the term "alpha" loosely. There will be extensive security details published, explaining every aspect of the identity proof system, client sessions, etc. They wi…

The first thing I thought about is a man in the middle attack with homoglyphs. I don't know if I'm paranoid, but look at this > keybase id maria pgp: C4B3 15B4 7154 5281 5100 1C58 C2A5 977B 0022 github: mаria_leah ✓ https://gist.github.com/23423 twitter: mаria_h20 ✓ https://t.co/mаria_h20/523554 site: mаriah20.com ✓ https://mаriah20.com/X904F... I looked up for 'maria', all ascii. The answer, served by a malicious se…

Hi riquito - this is a very legitimate concern, and it has to be reviewed individually for each type of proof keybase supports, in the client. With twitter, keybase, and github, you can't have a username containing any character other than an alphanumeric, dash, or underscore. Which means this kind of attack is impossible.

But for future identity proofs (domains, for example, which we've yet to implement), this kind of attack is real. Our approach here will be that anything outside of normal ascii will be highlighted and addressed to the user, as a serious warning.

Re: Keybase.io

#102

Post by sneak »

aidos wrote: post #78
sneak wrote: post #27

I really, really want crypto, specifically, safe and secure-by-default crypto, to become much more usable. Despite this hope, I can't seem to help the fact that the first thing that popped into my head when I read their webpage is "oh, they're wrapping and abstracting important key authentication and critical key trust configuration to make it more user-friendly, and implementing it all in javascript. WHAT COULD POSS…

Honest question, which part of writing it in JS makes it less safe? I understand that running in a browser is an inherently unsafe model because of the various mechanisms that make it impossible to track code that's running along side yours. How is it that JS is unsafe in a server environment?

The median programmers it attracts to write it.

Re: Keybase.io

#103

Post by mike-cardwell »

maxtaco wrote: post #45
ghayes wrote: post #36

Earlier quoted context omitted.

Well, to follow up, could this be extended to ownership of a domain (via DNS txt record)? Could we use this as a means of authentication of a self-signed certificate for a domain?

Yes to DNS, though we have to be careful here since DNS can be spoofed more easily than github or twitter proofs over https. I was thinking a slightly better way to prove ownership of foo.com would be to post a proof at https://foo.com/_keybase (or something similar). To spoof this, an attacker would have to spoof DNS and also the https certificate. Authenticating a self-signed domain certificate via keybase is a nea…

Have you heared of PKA? https://grepular.com/Publishing_PGP_Keys_in_the_DNS

If you want to encrypt a message to my key, just run the following command:

  gpg --auto-key-locate pka -ea -r mike([-dot-])cardwell([-at-])grepular([-dot-])com
It will automatically look up my PGP key in the DNS, fetch it, and encrypt to it. My DNS is secured using DNSSEC so if your resolve supports DNSSEC, you can be reasonably sure that the response is trustable.

  mike@glue:~$ dig +short txt mike.cardwell._pka.grepular.com
  "v=pka1\;fpr=35BCAF1D3AA21F843DC3B0CF70A5F5120018461F\;uri=http://grepular.com/0018461F.pub.asc"
  mike@glue:~$

Re: Keybase.io

#105

Post by murbard2 »

malgorithms wrote: post #8

Hi everyone, Chris here, I've been working with Max on Keybase. I can't help but feel this ended up scooped a bit early. (Crap!) Not a surprise, because HN is quick. The alpha site's changing every day, and we're working on the documentation now. I don't use the term "alpha" loosely. There will be extensive security details published, explaining every aspect of the identity proof system, client sessions, etc. They wi…

Could you do email verification by emailing a challenge to users, and having them reply with a signature of the challenge combined with their email address?

It does demonstrate control of the email account, and you cannot fake it either.

Re: Keybase.io

#106

Post by riquito »

malgorithms wrote: post #101
riquito wrote: post #84

Earlier quoted context omitted.

The first thing I thought about is a man in the middle attack with homoglyphs. I don't know if I'm paranoid, but look at this > keybase id maria pgp: C4B3 15B4 7154 5281 5100 1C58 C2A5 977B 0022 github: mаria_leah ✓ https://gist.github.com/23423 twitter: mаria_h20 ✓ https://t.co/mаria_h20/523554 site: mаriah20.com ✓ https://mаriah20.com/X904F... I looked up for 'maria', all ascii. The answer, served by a malicious se…

Hi riquito - this is a very legitimate concern, and it has to be reviewed individually for each type of proof keybase supports, in the client. With twitter, keybase, and github, you can't have a username containing any character other than an alphanumeric, dash, or underscore. Which means this kind of attack is impossible. But for future identity proofs (domains, for example, which we've yet to implement), this kind…

These are good news. Thank you and good work!

Re: Keybase.io

#107

Post by aidos »

sneak wrote: post #102
aidos wrote: post #78

Earlier quoted context omitted.

Honest question, which part of writing it in JS makes it less safe? I understand that running in a browser is an inherently unsafe model because of the various mechanisms that make it impossible to track code that's running along side yours. How is it that JS is unsafe in a server environment?

The median programmers it attracts to write it.

Argh. That barely warrants a response.

The average skill of developers using a language is low, therefore it's not possible for anything written in the language to be of high quality?

Wow. Even assuming that the initial assertion is correct, that's horrifically illogical.

True reason: you have an anti-js bias. You're welcome to that, but for goodness sake be rational in your hatred.

Re: Keybase.io

#108

Post by alokv28 »

addisonj wrote: post #16

Looks very cool, but one piece of feedback: Let the user know it is in invite-only beta on the homepage. I downloaded the command line util and tried to login, only to be let down :( Excited to try it out!

Same boat here! Any sense of how long the queue is?

Re: Keybase.io

#110

Post by fiatjaf »

midas007 wrote: post #90
theboss wrote: post #42

Earlier quoted context omitted.

I don't see why you don't just get the key once, allow you to verify it, and store it locally. It seems pointless to make all these extra requests to you. There's a reason that gpg does this..... Maria's twitter being hacked, Maria's github being hacked, Maria's Keystore being hacked....a lot can go wrong. There are still weaknesses like, you lie about a github and link to your own github, and lie about the public ke…

I don't see how this is any better than a keyserver and just asking confirming their GPG fingerprint by some other means. Not knowing someone and guessing that their fingerprint is right from some third party is very sketchy because it doesn't use a trustworthy, authoritative source (the other person). Also, WoT works best when people meet other people they trust in person and sign each other's keys as the GNU/Linux…

What the GNU/Linux community encourages is clearly not being useful for making lots of people use PGP.
Post reply on HN