Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase Exploding Messages

keybase.io

Post reply on HN
Print view View original

41–50 of 155 posts

Re: Keybase Exploding Messages

#41

Post by niftich »

e1ven wrote: post #21
ohazi wrote: post #9

Earlier quoted context omitted.

It is impossible to implement this feature "safely" even with trusted clients -- worst case I take a screenshot or even a photograph of the device displaying the message before it explodes. If you don't trust the person at the other end, this is never going to work. It's more useful for "we both agree that we don't want a paper trail" kind of thing.

Absolutely - That's my understanding as well. There are ways to mitigate (snapchat detects screenshots, etc) but no way to fully prevent - Someone could always use an external camera, etc. I was just really hoping that they had come up with some sort of cool technical way to stop the ability to decode messages after XYZ time, even if they couldn't prevent it from being copied once decoded. For example, imagine if a m…

This is exactly how most DRM schemes work. You ping the keyserver a key, they check if you're still authorized, and if you are, they send you a key. There's even a bunch of tech that got built into commercial OSes [1][2] and hardware in an effort to try really, really hard not to expose decrypted content outside some protected path. But if a chunk of decrypted content is displayed on a screen, there's always the analog hole, e.g. taking pictures or a video of the display.

Nonetheless, it'd be interesting if all this effort, which got done because of the lobbying of major media rightsholders, was re-used for interpersonal communication.

[1] https://en.wikipedia.org/wiki/Protected_Media_Path [2] https://arstechnica.com/gadgets/2016/11/netflix-4k-streaming...

Re: Keybase Exploding Messages

#42

Post by ggg9990 »

tedunangst wrote: post #26
ggg9990 wrote: post #20

Earlier quoted context omitted.

A dead simple way to thwart the “screenshot” attack is to release a tool for accurately falsifying a screenshot. I’ve never seen this employed in practice though.

How is any bitmap editor not such a tool?

If it’s made by the company making the messaging app, it will be pixel perfect, and will only take a few seconds to make instead of a few hours. And if you create one for a date in the past they can use the UI they had at that time.

Re: Keybase Exploding Messages

#43

Post by LeifCarrotson »

ggg9990 wrote: post #20
ohazi wrote: post #9

Earlier quoted context omitted.

It is impossible to implement this feature "safely" even with trusted clients -- worst case I take a screenshot or even a photograph of the device displaying the message before it explodes. If you don't trust the person at the other end, this is never going to work. It's more useful for "we both agree that we don't want a paper trail" kind of thing.

A dead simple way to thwart the “screenshot” attack is to release a tool for accurately falsifying a screenshot. I’ve never seen this employed in practice though.

That's an interesting way to combat certain kinds of attacks - those in which the screenshot 'reveals' embarrassing, illicit, or illegal communication: things you've done or intend to do that have no external evidence aside from the message itself.

But it does not combat attacks that are not embarrassing but rather a release of information you are known to have but which is intended to be kept secret, or which is easily verified: if someone captures your social security number, private key, or home address in a screenshot, you'd better be really good at bluffing.

Re: Keybase Exploding Messages

#44

Post by DanielBMarkham »

malgorithms wrote: post #38

Author here. I'm seeing the same comment in 4 different places on here, worded with various amounts of hostility. I now wish I had addressed this in the FAQ on the post. There's the suggestion that an exploding feature is worthless, given your partner can just take a screenshot or video of what you sent. This suggestion is missing (1) that your relationship with a partner is disproportionately okay at the time you se…

I hate to use this adjective, but this feature is cute. I love the little bomb. I love the concept. I love how you've applied it to several types of things. And I love how you've taken something that could be complicated and made it simple.

Keep up the good work, guys!

Re: Keybase Exploding Messages

#45

Post by lakechfoma »

malgorithms wrote: post #38

Author here. I'm seeing the same comment in 4 different places on here, worded with various amounts of hostility. I now wish I had addressed this in the FAQ on the post. There's the suggestion that an exploding feature is worthless, given your partner can just take a screenshot or video of what you sent. This suggestion is missing (1) that your relationship with a partner is disproportionately okay at the time you se…

I'm not a Snapchat user but doesn't that app, at least on Android, alert senders when a receiver takes a screenshot? You can still take a picture with a second device and that functionality isn't totally portable, but interesting feature. Do you think that concept has any utility here?

Re: Keybase Exploding Messages

#46

Post by volaski »

malgorithms wrote: post #38

Author here. I'm seeing the same comment in 4 different places on here, worded with various amounts of hostility. I now wish I had addressed this in the FAQ on the post. There's the suggestion that an exploding feature is worthless, given your partner can just take a screenshot or video of what you sent. This suggestion is missing (1) that your relationship with a partner is disproportionately okay at the time you se…

I don't think anyone's being as hostile as you make it out to be. They're just talking about how you can't really guarantee safety, which is true.

And I find it weird that you're comparing yourself with Snapchat. Snapchat is a casual app, targeted at a completely different audience than the people Keybase targets (at least that's the impression I got so far)

Also Snapchat is mobile only product, which makes all the difference. It's much easier to detect screenshotting on mobile than desktop. And as far as I know, Keybase is desktop-first app. So it's kind of ridiculous that you're comparing yourself to snapchat.

I don't know if you are aware of above distinctions or not, but if you're not aware of this, there's something wrong here. You guys are supposed to be completely aware of all these subtle differences. And if you ARE aware of this, why are you trying to make these claims pretending there's nothing wrong?

I have nothing against Keybase, I'm just pointing out the faulty logic in this specific comment you're making (which happens to be hostile towards those who are just pointing out the issue with no trolling intent)

Re: Keybase Exploding Messages

#47

Post by oconnor663 »

tylersmith wrote: post #25
Sir_Cmpwn wrote: post #8

This very article shows you the problem with "features" like this. You see that video demonstrating the feature? Notice how you can read the content of the message which was supposedly deleted?

In theory not having the signatures means the messages could be falsified, but many people would trust a screen capture still. Regardless, the signatures themselves could be extracted before "exploding" so the feature really is promoting unsafe security assumptions

There is a section about repudiability near the bottom of the article.

Re: Keybase Exploding Messages

#49

Post by ahnick »

volaski wrote: post #46
malgorithms wrote: post #38

Author here. I'm seeing the same comment in 4 different places on here, worded with various amounts of hostility. I now wish I had addressed this in the FAQ on the post. There's the suggestion that an exploding feature is worthless, given your partner can just take a screenshot or video of what you sent. This suggestion is missing (1) that your relationship with a partner is disproportionately okay at the time you se…

I don't think anyone's being as hostile as you make it out to be. They're just talking about how you can't really guarantee safety, which is true. And I find it weird that you're comparing yourself with Snapchat. Snapchat is a casual app, targeted at a completely different audience than the people Keybase targets (at least that's the impression I got so far) Also Snapchat is mobile only product, which makes all the d…

Keybase may have started from the technical community b/c of its foundation with how it handles identity and encryption, but I definitely don't view it as an app targeted at a different audience. It is an app that can be used by the general public and I use the mobile version quite often. I don't find the comparison odd at all.

Re: Keybase Exploding Messages

#50

Post by saghm »

volaski wrote: post #46
malgorithms wrote: post #38

Author here. I'm seeing the same comment in 4 different places on here, worded with various amounts of hostility. I now wish I had addressed this in the FAQ on the post. There's the suggestion that an exploding feature is worthless, given your partner can just take a screenshot or video of what you sent. This suggestion is missing (1) that your relationship with a partner is disproportionately okay at the time you se…

I don't think anyone's being as hostile as you make it out to be. They're just talking about how you can't really guarantee safety, which is true. And I find it weird that you're comparing yourself with Snapchat. Snapchat is a casual app, targeted at a completely different audience than the people Keybase targets (at least that's the impression I got so far) Also Snapchat is mobile only product, which makes all the d…

> And I find it weird that you're comparing yourself with Snapchat. Snapchat is a casual app, targeted at a completely different audience than the people Keybase targets (at least that's the impression I got so far)

I don't think they're comparing themself to Snapchat; I think they're using a hypothetical situation that everyone can understand in order to explain the threats that an "exploding message" protects against; Snapchat is used merely because the scenario is easy to understand.

EDIT: grammar

Post reply on HN