How does keybase make money? I am afraid they are in the business of selling my online identity.
Keybase's mission is to make encryption mainstream
61–70 of 84 posts
Re: Keybase's mission is to make encryption mainstream
#62A good article that covers what Keybase is, where they came from, what they try to do, and where they're trying to go -- although you couldn't tell from the headline. As in the article body, Slack is namedropped just for effect; Keybase Teams being a decent proof-of-concept of a popular kind of application to show that the ideas behind Keybase can be used to build real products. That being said, Keybase has been movi…
When we started Keybase, it was a hobby project to address shortcomings of PGP. Max and I both had just downloaded software packages and wanted to verify them, and it took us hours. At least one of them was bitcoin; I recall staring in awe as Max showed me the countless Gavin Andresen impostors on the popular PGP key servers. We really thought we'd stick up the Keybase directory, make some basic scripts, and move on.…
I see the client source is on github (yay!), but what about the server source? Is this service federated? If not, then this is yet another silo'd solution (with a proprietary backend) dependent upon a single company to maintain..
Re: Keybase's mission is to make encryption mainstream
#63Earlier quoted context omitted.
When we started Keybase, it was a hobby project to address shortcomings of PGP. Max and I both had just downloaded software packages and wanted to verify them, and it took us hours. At least one of them was bitcoin; I recall staring in awe as Max showed me the countless Gavin Andresen impostors on the popular PGP key servers. We really thought we'd stick up the Keybase directory, make some basic scripts, and move on.…
Excellent summary of your vision. > (1) (...) Whether you're following a famous developer or you're looking up your own sibling, odds are in 2017 you know a public definition of them: a Twitter account, Reddit account, Facebook, etc. What do you think about OpenPGP Linked Identities proposal [0] that does exactly what you described but in a decentralized way? [0]: https://tools.ietf.org/html/draft-vb-openpgp-linked-i…
It would be great to see it deployed, but it solves only (1), and even so, not completely. I couldn't find it in the doc, is there a story for revocations? Part of our concern about the PGP story is that malicious servers can suppress revocations. In Keybase's architecture, we've committed to an append-only data structure, which makes it impossible to withhold revocations without being detected. In a decentralized setting, you could do something similar with a blockchain like Bitcoin or Ethereum, but for usability, it would be important to do so without requiring mobile clients to download the entire blockchain. (BTW, that draft cites Keybase as a motivation for their approach :) )
Re: Keybase's mission is to make encryption mainstream
#64Earlier quoted context omitted.
Always save the keys (or the scanner code) whenever you add them to Authenticator. Then, when you get a new phone (or whatever) you can just re-import the keys.
It's pretty stupid that Google doesn't allow for any way of getting the keys out of it's 2FA app. Your only transition path is backup/restoring an entire device to a newer one of the same OS. There's no direct path to migrate from say an iPhone to an Android based phone without manually adding each 2FA entry to the new device.
> Your only transition path is backup/restoring an entire device to a newer one of the same OS.
This isn't an option on iOS! When I bought an iPhone a year and a half ago, the 2FA keys were not included in my iTunes device backup, even through backup encryption was turned on. I had to manually create new keys for all seven sites I use Google Authenticator with.
Re: Keybase's mission is to make encryption mainstream
#65> It’s mission: to make encryption mainstream.
Not to be pedantic, but is this normal in a major(?) publication?
Re: Keybase's mission is to make encryption mainstream
#66> It’s mission: to make encryption mainstream. Not to be pedantic, but is this normal in a major(?) publication?
From what I've seen of writers, they're barely literate before an editing pass.
Re: Keybase's mission is to make encryption mainstream
#67Earlier quoted context omitted.
It's pretty stupid that Google doesn't allow for any way of getting the keys out of it's 2FA app. Your only transition path is backup/restoring an entire device to a newer one of the same OS. There's no direct path to migrate from say an iPhone to an Android based phone without manually adding each 2FA entry to the new device.
> Your only transition path is backup/restoring an entire device to a newer one of the same OS. This isn't an option on iOS! When I bought an iPhone a year and a half ago, the 2FA keys were not included in my iTunes device backup, even through backup encryption was turned on. I had to manually create new keys for all seven sites I use Google Authenticator with.
They're definitely included as I've done it a number of times. I'm going to wager you don't have your iTunes set up to backup apps from your phone. I think there's a separate check box you have to click once to enable it.
Re: Keybase's mission is to make encryption mainstream
#68Earlier quoted context omitted.
On Android, I use FreeOTP; I can make backups with `adb`. Separately, I use KeepassXC ( https://keepassxc.org ) and store all my 2fa seeds in a dedicated (separate) 2fa database which I keep locked. You can also keep it in the same database as your password db if you want to trade the 2nd factor for convenience but still get the added benefit of one time passwords.
> I can make backups with `adb` does it follow that an attacker can make a "backup" of your 2fa codes as well, if they get ahold of your phone for a minute or two?
Physical device access is where this kind of security ends. If someone stealing your phone just to get your 2fa codes is a threat vector for you, you should be using different/additional factors.
In any event, as was pointed out, adb needs usb debugging turned on, which needs the device unlocked to be enabled.
Re: Keybase's mission is to make encryption mainstream
#69Earlier quoted context omitted.
Excellent summary of your vision. > (1) (...) Whether you're following a famous developer or you're looking up your own sibling, odds are in 2017 you know a public definition of them: a Twitter account, Reddit account, Facebook, etc. What do you think about OpenPGP Linked Identities proposal [0] that does exactly what you described but in a decentralized way? [0]: https://tools.ietf.org/html/draft-vb-openpgp-linked-i…
It would be great to see it deployed, but it solves only (1), and even so, not completely. I couldn't find it in the doc, is there a story for revocations? Part of our concern about the PGP story is that malicious servers can suppress revocations. In Keybase's architecture, we've committed to an append-only data structure, which makes it impossible to withhold revocations without being detected. In a decentralized se…
> BTW, that draft cites Keybase as a motivation for their approach
Yes, I know. Without Keybase this draft would probably never exist in the first place :)
> I couldn't find it in the doc, is there a story for revocations?
Yes, it supports revocation as links are stored as User Attributes (similar to UIDs).
> In a decentralized setting, you could do something similar with a blockchain like Bitcoin or Ethereum, but for usability, it would be important to do so without requiring mobile clients to download the entire blockchain.
Yes, I've been thinking about using Blockchain for that purpose but I'm waiting for something more concrete to materialize out of Key Transparency [0]. As far as I like Keybase for something so fundamental as identity I think a distributed solution would eventually be necessary.
As far as I remember you write sigchain Merkle root to Bitcoin [1], that's a good security measure. (although you may consider using OP_RETURN outputs rather than fake output addresses, that optimizes unspent transactions database on each Bitcoin node).
[0]: https://github.com/google/keytransparency/
[1]: https://keybase.io/docs/server_security/merkle_root_in_bitco...
Re: Keybase's mission is to make encryption mainstream
#70This is going to sound like a dumb question, but.... how much would encryption help? Even if we encrypted all of our data at rest and on the wire, I feel like a lot of security vulnerabilities wouldn't have been prevented with encryption. If you have any way of interacting with the application or the database, it's basically game over, no? Is there any data on this?
I’m not sure what threat model you’re proposing. If an attacker has control of your computer or the keybase app, then yes, it’s game over. But encryption removes the hosting entity as what would otherwise be a single point of failure. If you hack keybase the organization, you don’t immediately get access to everyone’s everything (in contrast with Equifax). An attacker would need to infiltrate the codebase and then re…
I suppose I'd like to see what threat models actually apply to companies, and what vectors are most often used to get pwned (outside of social engineering). I understand what encryption prevents, but I don't understand how helpful it is in practice.