Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase's mission is to make encryption mainstream

observer.com

Post reply on HN
Print view View original

41–50 of 84 posts

Re: Keybase's mission is to make encryption mainstream

#41

Post by zapu »

fish_fan wrote: post #37
niftich wrote: post #4

A good article that covers what Keybase is, where they came from, what they try to do, and where they're trying to go -- although you couldn't tell from the headline. As in the article body, Slack is namedropped just for effect; Keybase Teams being a decent proof-of-concept of a popular kind of application to show that the ideas behind Keybase can be used to build real products. That being said, Keybase has been movi…

I wonder if, in the mid term future, you could see e2e encryption over slack and other offerings if you added slack as a team member—granted, they’d be storing the messages plain text on the slack side, but it’d ease and encourage transition onto keybase teams rather than eg SAML.

Sometimes, when Slack e-mails me that someone has mentioned me in a channel, and in the e-mail there is content of the message, I have a brief thought of "how do they know-... oh". I'm slowly getting used to e2e provided by various IMs, as well as encrypted at rest e-mail providers (personally I user Protonmail) - it's not something extraordinary anymore.

Re: Keybase's mission is to make encryption mainstream

#42

Post by tuxxy »

paxy wrote: post #19

They don't really address the fact that every single Slack "leak" is from someone already part of the team taking screenshots of the conversation. How does any kind of encryption help that? Also doesn't mention everything you lose out on with this approach - like searching through message history. It's a neat product I guess, but mentioning Slack in every single line seems more to get eyeballs than a valid comparison…

Why can't you just store the chat data locally and search it there? Chat data is already small enough, it just needs to be stored in a searchable format.

You don't need to store all of it either, just store the past month or so (or store what the user chooses to store). When the user needs data in the past, the user can download that data from the dates needed.

I have IRC logs with years worth of chat data and they only take up a few MBs.

Re: Keybase's mission is to make encryption mainstream

#43

Post by mwj »

dangero wrote: post #5

Tangent, but the article mentions using Google Authenticator -- I was going to start using that recently, but the reviews indicated it had some really big problems with restoring when you get a new phone etc and Google isn't really maintaining it. https://itunes.apple.com/us/app/google-authenticator/id38849... Can anyone comment on their 2fa approach to google?

Authenticator Plus. It's a paid product, but allows me to sync my TOTP tokens to my Google drive account, so I'll never have that problem again.

Re: Keybase's mission is to make encryption mainstream

#44

Post by morley »

dangero wrote: post #5

Tangent, but the article mentions using Google Authenticator -- I was going to start using that recently, but the reviews indicated it had some really big problems with restoring when you get a new phone etc and Google isn't really maintaining it. https://itunes.apple.com/us/app/google-authenticator/id38849... Can anyone comment on their 2fa approach to google?

I personally use Authy, and it's survived several migrations to new phones.

Re: Keybase's mission is to make encryption mainstream

#45

Post by vvanders »

malgorithms wrote: post #31
niftich wrote: post #4

A good article that covers what Keybase is, where they came from, what they try to do, and where they're trying to go -- although you couldn't tell from the headline. As in the article body, Slack is namedropped just for effect; Keybase Teams being a decent proof-of-concept of a popular kind of application to show that the ideas behind Keybase can be used to build real products. That being said, Keybase has been movi…

When we started Keybase, it was a hobby project to address shortcomings of PGP. Max and I both had just downloaded software packages and wanted to verify them, and it took us hours. At least one of them was bitcoin; I recall staring in awe as Max showed me the countless Gavin Andresen impostors on the popular PGP key servers. We really thought we'd stick up the Keybase directory, make some basic scripts, and move on.…

I have nothing to add other than that I really like how KeyBase decided to do identity. Letting the user decide how much they trust different services and using them to verify is a fantastic solution.

Re: Keybase's mission is to make encryption mainstream

#46

Post by philsnow »

scrollaway wrote: post #6
dangero wrote: post #5

Tangent, but the article mentions using Google Authenticator -- I was going to start using that recently, but the reviews indicated it had some really big problems with restoring when you get a new phone etc and Google isn't really maintaining it. https://itunes.apple.com/us/app/google-authenticator/id38849... Can anyone comment on their 2fa approach to google?

On Android, I use FreeOTP; I can make backups with `adb`. Separately, I use KeepassXC ( https://keepassxc.org ) and store all my 2fa seeds in a dedicated (separate) 2fa database which I keep locked. You can also keep it in the same database as your password db if you want to trade the 2nd factor for convenience but still get the added benefit of one time passwords.

> I can make backups with `adb`

does it follow that an attacker can make a "backup" of your 2fa codes as well, if they get ahold of your phone for a minute or two?

Re: Keybase's mission is to make encryption mainstream

#47

Post by james_pm »

paxy wrote: post #19

They don't really address the fact that every single Slack "leak" is from someone already part of the team taking screenshots of the conversation. How does any kind of encryption help that? Also doesn't mention everything you lose out on with this approach - like searching through message history. It's a neat product I guess, but mentioning Slack in every single line seems more to get eyeballs than a valid comparison…

If you can't trust all the members of the team, or the person you send the message to, then no amount of encryption will save you.

But this does remove (reduce?) the need to trust that the the 3rd party provider (eg. Slack) is capable of securing your data and is also protecting it from the prying eyes of those you don't choose to trust explicitly.

Re: Keybase's mission is to make encryption mainstream

#48

Post by notheguyouthink »

gglitch wrote: post #32
notheguyouthink wrote: post #2

> Two veteran entrepreneurs are running a little startup built around making it easy to build web and mobile applications from day one that make data impossible for a digital trespasser to read. In fact, it encrypts data in such a way that even if you use some company’s service, that company can’t see what you’re doing with it. Is it? Not that I'm questioning Keybase, I just had no idea they were offering some type o…

I'm new with it myself, but I think part of what's being described is the option you have, when you have a Keybase account and the Keybase browser plugin and you're logged into a third party system (such as Fbook), of clicking on a Keybase icon for a given user and sending an e2e encrypted message from your Keybase account to theirs (even where they don't have one yet--if they make one later and associate it with the…

Ah hah, this seems to be the answer then. Thanks!

I like that idea of encoding before it hits FB/etc. Though, the level of security provided by a browser plugin makes me a bit nervous. Not an educated nervousness mind you.. I just tend to not trust them, and how well sandboxed they are, etc. It's the reason I also don't use browser plugins for password management.

Post reply on HN