Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase iOS Has a Backdoor?

sneak.berlin

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Keybase iOS Has a Backdoor?

#21

Post by seveneightn9ne »

lucb1e wrote: post #11

So basically: - You can send a message to anyone with the iOS Keybase client, asking it to sign a message saying that a certain XLM address is theirs - Your client will happily and automatically do so and add it to your Keybase profile page, no interaction needed I base this summary on the statements " Keybase updated their iOS client to sign an attestation, as a user, that a given stellar address belongs to them, ev…

No, I think it's saying that your client only does this at the request of the keybase server to create an initial XLM address for the user, not that it will on-demand add random stellar addresses to the user's profile.

EDIT: See malgorithms's comment; it doesn't even do this much

Re: Keybase iOS Has a Backdoor?

#22

Post by sneak »

crazygringo wrote: post #20

Hold on, I'm confused. This isn't allowing anyone to arbitrarily add any Stellar key to somebody else's profile or anything, is it? (And thus redirect actual money?) It's just generating a new Stellar profile/key for each Keybase user automatically, and affirming that it belongs to each Keybase user? Hardly seems like a backdoor, just a mildly annoying/unwanted marketing partnership. Actually not even partnership --…

> affirming that it belongs to each Keybase user

Falsely/fraudulently affirming, using a cryptographic signature silently and non-consensually generated, yes. Those keys it claims are mine are not; I have no knowledge of them. The claim is incorrect, unlike each and every other item on my profile page, which I explicitly signed.

This is the same concept of a backdoor as when a messaging app signs a wiretap key without the user's consent or knowledge. The same thing has happened here.

It's one thing to get "their username on GitHub is 'x'" wrong. It's another thing entirely to say "you can send real, actual money to this person at AN ADDRESS THAT BELONGS TO THEM, 'x'", when I have no knowledge of the keys for that payment destination and no desire to receive such payments; it is blatantly fraudulent that their software has used my private keys to sign and publish such a statement.

Would you tolerate an email client that silently changed your checking account or routing number on an outbound email before PGP signing it?

Re: Keybase iOS Has a Backdoor?

#23

Post by rcthompson »

crazygringo wrote: post #20

Hold on, I'm confused. This isn't allowing anyone to arbitrarily add any Stellar key to somebody else's profile or anything, is it? (And thus redirect actual money?) It's just generating a new Stellar profile/key for each Keybase user automatically, and affirming that it belongs to each Keybase user? Hardly seems like a backdoor, just a mildly annoying/unwanted marketing partnership. Actually not even partnership --…

Edit: My comment took at face value the OP's claim that the Stellar account was generated without their knowledge. Obviously, if that claim is false, as Keybase's official response indicates, then my comment is invalid.

Original comment: It does seem more than a bit questionable that the Stellar account is added automatically to the user's profile among a list where every other account/key/whatever in that list was manually added by the user. (As pointed out by the OP)

Re: Keybase iOS Has a Backdoor?

#25

Post by shawnz »

sneak wrote: post #12
buildbuildbuild wrote: post #9

Signing an attestation without user consent is certainly a huge breach of Keybase’s trust, but describing this as a “backdoor” feels inaccurate.

https://keybase.io/blog/2014-10-08/the-horror-of-a-secure-go... Keybase uses the term "backdoor" in their blog to describe an app using a key to sign another key as valid (violating user intent/consent).

That is not how they use the term at all.

> A “golden key” is just another, more pleasant, word for a backdoor—something that allows people access to your data without going through you directly.

Clearly in this situation nothing has been done to allow anyone else to access your data without consent.

I get that you are upset about being made to look like you endorse a cryptocurrency, but that's not an excuse to be purposely misleading. You should edit the post and remove the backdoor claim.

Re: Keybase iOS Has a Backdoor?

#26

Post by grinsekatze »

mfer wrote: post #19

Not every keybase user has a stellar attestation. When it happened to me I think I had to take some action. I don't remember the exact language. Anyone have that detail?

I think you’re right. If I remember correctly I did not have a stellar address until I clicked the ‘Wallet’ button in the Keybase app. That action and the device it was issued from was recorded in my chainlink on Feb 15, 2019 .. which sounds about right.

I also remember feeling a bit tricked, because I wasn’t aware that by clicking that button a stellar address would be created and permanently linked to me.

Re: Keybase iOS Has a Backdoor?

#27

Post by aeternum »

crazygringo wrote: post #20

Hold on, I'm confused. This isn't allowing anyone to arbitrarily add any Stellar key to somebody else's profile or anything, is it? (And thus redirect actual money?) It's just generating a new Stellar profile/key for each Keybase user automatically, and affirming that it belongs to each Keybase user? Hardly seems like a backdoor, just a mildly annoying/unwanted marketing partnership. Actually not even partnership --…

The affirmation part is the problem. Generating trustworthy signatures is a critical part of a cryptographic system.

Signing something requires access to the user's private key. If that key can be used by other entities to produce signatures, it is no longer private and can no longer be trusted.

Re: Keybase iOS Has a Backdoor?

#28

Post by vageli »

shawnz wrote: post #25
sneak wrote: post #12

Earlier quoted context omitted.

https://keybase.io/blog/2014-10-08/the-horror-of-a-secure-go... Keybase uses the term "backdoor" in their blog to describe an app using a key to sign another key as valid (violating user intent/consent).

That is not how they use the term at all. > A “golden key” is just another, more pleasant, word for a backdoor—something that allows people access to your data without going through you directly. Clearly in this situation nothing has been done to allow anyone else to access your data without consent. I get that you are upset about being made to look like you endorse a cryptocurrency, but that's not an excuse to be pu…

They signed an attestation, that is essentially using your authority to say something is yours. I would consider my ability to consent as something that belongs to me. This change indeed allows people to access my data (in this case, saying I have something I don't, and using my authority without permission).

If they automatically joined my keybase user to my hackernews profile without my consent, it would be just as egregious.

Re: Keybase iOS Has a Backdoor?

#29

Post by segmondy »

buildbuildbuild wrote: post #9

Signing an attestation without user consent is certainly a huge breach of Keybase’s trust, but describing this as a “backdoor” feels inaccurate.

The point is that if keybase can sign the attestation on your behalf, they can further more sign other things on your behalf claiming it's you hence the reason he calls it a backdoor.

Re: Keybase iOS Has a Backdoor?

#30

Post by segmondy »

hrdwdmrbl wrote: post #3

How exactly is signing a transaction on a user's behalf a backdoor? Headline seems extremely clickbaity. At worst it's sketchy. For me as a user I don't even really care. Should they have asked for explicit consent? Yeah I guess...

keybase uses private/pub key. if keybase can use your private key to sign on your behalf, then maybe they can use that same private key to read private documents, transfer money, etc. no one but the user should ever have or know about the private key.
Post reply on HN