Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase iOS Has a Backdoor?

sneak.berlin

Post reply on HN
Print view View original

51–56 of 56 posts

Re: Keybase iOS Has a Backdoor?

#51

Post by sneak »

shakna wrote: post #50
sneak wrote: post #49

Earlier quoted context omitted.

> Someone below threw out the word "libel" here. Where? Your comment, and now this reply, are the only occurrences of that word on this page. It's really irksome when someone tells me I consent to something that I don't. I'm the authority on whether or not my keys were used improperly—no one else. You used my keys in a way in which I did not want. That's the beginning and the end of it. I hope you got paid a lot for…

Those users appear to acknowledge that there was consent sort before the key was generated. > I created a stellar wallet to explore the feature

Creating a wallet (generating a keypair offline) and signing+publishing an attestation using a non-wallet keybase key to publicly associate that wallet on your profile are two different things. Adding cryptocurrency support is fine; using my private keys without my consent to publish an implicit endorsement of that cryptocurrency is not, especially when it can't be removed. It's a dark pattern that enables paid advertising designed to look like an endorsement/user engagement.

Furthermore, there is a way to remove/revoke every other type of attestation/claim on a keybase profile - except for the permanent, paid ad for Stellar.

See: https://github.com/keybase/client/issues/20022#issuecomment-...

It sounds like that part is being fixed, though, which is good.

Re: Keybase iOS Has a Backdoor?

#52

Post by sneak »

malgorithms wrote: post #34

Official response here - I work for Keybase. This article isn't just misleading; it's entirely false, and the title is both highly damaging AND false. Someone below threw out the word "libel" here. I don't know about that, but it's incredibly frustrating to read this title on HN right now. * THERE IS NO BACKDOOR HERE. Neither the especially scary kind suggested by the title (everyone assumes encryption breaking!), no…

> So to be clear (1) this writer did in fact have that Stellar Key. And (2) we, Keybase, did not. And (3) they knew they were doing it. I encourage anyone curious to go try it out -- the flow has not changed.

1) I have never seen the private key you claim I "in fact have".

2) I have no way of verifying this information, but I will accept your words on their face.

3) I did not. Your own description of the UX flow says nothing of using the keybase (not Stellar) device key to sign an attestation/proof. That was the unwanted bit, the use of my keybase (again, not Stellar) key to publicly state that I wish to use Stellar.

I'll make a screencap video of the flow if necessary to illustrate how sketchy it is.

Re: Keybase iOS Has a Backdoor?

#53

Post by h4t »

malgorithms wrote: post #34

Official response here - I work for Keybase. This article isn't just misleading; it's entirely false, and the title is both highly damaging AND false. Someone below threw out the word "libel" here. I don't know about that, but it's incredibly frustrating to read this title on HN right now. * THERE IS NO BACKDOOR HERE. Neither the especially scary kind suggested by the title (everyone assumes encryption breaking!), no…

The people complaining need to review a glossary before they start complaining. Maybe also becoming knowledgeable about the subject matter might help.

Re: Keybase iOS Has a Backdoor?

#54

Post by phyzome »

malgorithms wrote: post #34

Official response here - I work for Keybase. This article isn't just misleading; it's entirely false, and the title is both highly damaging AND false. Someone below threw out the word "libel" here. I don't know about that, but it's incredibly frustrating to read this title on HN right now. * THERE IS NO BACKDOOR HERE. Neither the especially scary kind suggested by the title (everyone assumes encryption breaking!), no…

Random user here, I can confirm, at least for the desktop app. I had to explicitly agree to create a wallet.

I checked a few friends' profiles. I knew one of them hadn't set up a wallet and hey, you know what? Their profile doesn't include a Stellar address.

Re: Keybase iOS Has a Backdoor?

#55

Post by 40four »

sneak wrote: post #52
malgorithms wrote: post #34

Official response here - I work for Keybase. This article isn't just misleading; it's entirely false, and the title is both highly damaging AND false. Someone below threw out the word "libel" here. I don't know about that, but it's incredibly frustrating to read this title on HN right now. * THERE IS NO BACKDOOR HERE. Neither the especially scary kind suggested by the title (everyone assumes encryption breaking!), no…

> So to be clear (1) this writer did in fact have that Stellar Key. And (2) we, Keybase, did not. And (3) they knew they were doing it. I encourage anyone curious to go try it out -- the flow has not changed. 1) I have never seen the private key you claim I "in fact have". 2) I have no way of verifying this information, but I will accept your words on their face. 3) I did not. Your own description of the UX flow says…

The Stellar private key is easy to find in the wallet settings on all of the clients.

Also, I made a test account from scratch to test out the UX flow. Here's what I found (Note, this is the Android version, not iOS).

1) I created a new username and entered the new account on mobile client.

2) I created a password so I could log into the web client.

3) Out of curiosity I went ahead and clicked the wallet tab in the burger menu.

4) I'm then presented with a brief (full screen) 'Welcome' message and have to click a button that says 'Open Your Wallet' to continue.

5) once that button is clicked you are presented with a more lengthy, full screen, disclaimer that takes a minute to read.

Here is what point #3 says 3. CRYPTOCURRENCY ISN'T REALLY ANONYMOUS. When you sign your first of "default" Stellar address into your signature chain on Keybase, you are announcing it publicly as a known address for you. Assume that all of your transactions from that account are public. You can have as many Stellar accounts as you like in Keybase, but whenever you make one your default, that one is then announced as your. Consider that data permanent.

6) I then clicked 'Not now' button. Instead of 'Yes, I agree' button.

7) I log into my web client to see how my new account looks, and in fact, there is no Stellar wallet or address.

Seems to me like you have to explicitly opt into creating a wallet, and the disclaimer is very clear about signing it into your signature chain and announcing it publicly.

So unless the iOS client does not have the same disclaimer and wording, which would surprise me, I'm still not understanding what the problem is. The developer also said they are working on the feature totally remove your default Stellar wallet, so I imagine in the near future you can delete it.

Re: Keybase iOS Has a Backdoor?

#56

Post by shawnz »

vageli wrote: post #28
shawnz wrote: post #25

Earlier quoted context omitted.

That is not how they use the term at all. > A “golden key” is just another, more pleasant, word for a backdoor—something that allows people access to your data without going through you directly. Clearly in this situation nothing has been done to allow anyone else to access your data without consent. I get that you are upset about being made to look like you endorse a cryptocurrency, but that's not an excuse to be pu…

They signed an attestation, that is essentially using your authority to say something is yours. I would consider my ability to consent as something that belongs to me. This change indeed allows people to access my data (in this case, saying I have something I don't, and using my authority without permission). If they automatically joined my keybase user to my hackernews profile without my consent, it would be just as…

You actually do have the key in question though, so they did not claim that you have something you don't.

Furthermore the change did not give them more access than they had previously like you are subtly implying here. The app could already make attestations on behalf of the user since that is what it's designed to do.

> If they automatically joined my keybase user to my hackernews profile without my consent, it would be just as egregious.

Egregious, maybe, but also not a backdoor.

Post reply on HN