Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keys.pub – Manage cryptographic keys and user identities

keys.pub

Post reply on HN
Print view View original

61–70 of 92 posts

Re: Keys.pub – Manage cryptographic keys and user identities

#61

Post by Leace »

everfree wrote: post #42
emanlin wrote: post #33

Earlier quoted context omitted.

Keybase jumped the shark with their crypto coin offering.

I keep hearing people say this, but I don't understand it. It was a fun little giveaway experiment funded by someone else, in the spirit of the company's focus on cryptography. I don't visit the cryptocurrency tab anymore, and it's not like it gets in the way or anything.

> It was a fun little giveaway experiment funded by someone else, in the spirit of the company's focus on cryptography.

It was not "someone else". Keybase is directly funded by Stellar (source: https://keybase.io/blog/keybase-stellar) and the crypto offering was just a PR/marketing move to increase adoption for crypto of Stellar not something "in the spirit of the company's focus on cryptography".

Re: Keys.pub – Manage cryptographic keys and user identities

#62

Post by acqq »

gbriel wrote: post #43

Hi all, I'm the author of keys.pub. Can the mods change the title of this post at all? This project is meant to be supportive of ideas from Keybase and to promote Saltpack and this title is weirdly disparaging. (Edit: Title was changed, thanks!) Thanks everyone for the feedback. This project is in its early stages but the goal is to make it easier to manage and securely store keys and secrets. I'm currently working o…

What are the algorithms used for encryption? What are the defaults, do they now match the currently best known approaches?

Also why can't I use the application to do symmetric encryption? Namely the problem with GPG is that its defaults are still ancient (maybefor compatibility with whatever, I don't remember the excuse) and to reach the currently best settings one has to jump many, many hoops, even for simple task of symmetric encryption.

Re: Keys.pub – Manage cryptographic keys and user identities

#63

Post by jwr »

Question is, will this become a useful tool or a bloated multi-purpose behemoth (with no clearly defined purpose) like Keybase did?

We badly need good simple tools for encryption. For all the criticism of GPG coming from the savvy crypto-crowd, there is still no other tool that performs common encryption-related tasks quickly and easily.

Re: Keys.pub – Manage cryptographic keys and user identities

#64

Post by jwr »

StavrosK wrote: post #10
vorpalhex wrote: post #4

I was a very early user of Keybase and I've been super disappointed in the direction they've gone. They've had some neat ideas along the way but packing them onto the key service and the cryptocurrency missteps have caused me to shy away from them. This looks like a good start for a real competitor. Obviously it's early but I'm seeing the right things.

I see this from a lot of people and I'm puzzled, can you not just avoid using the features you don't like? I don't see anyone going "I used to use VS Code but they added a database viewer so I stopped".

Keybase went from a command-line tool with a clear purpose to a behemoth requiring an installer, a resident daemon, and a permanent menu-bar icon. I can't even trust a tool that is so complex (and likely has a huge attack surface).

These days, I don't even know what keybase is for. What is it for, really?

Re: Keys.pub – Manage cryptographic keys and user identities

#65

Post by doomrobo »

jwr wrote: post #63

Question is, will this become a useful tool or a bloated multi-purpose behemoth (with no clearly defined purpose) like Keybase did? We badly need good simple tools for encryption. For all the criticism of GPG coming from the savvy crypto-crowd, there is still no other tool that performs common encryption-related tasks quickly and easily.

age is the standard answer to this https://age-encryption.org/

Re: Keys.pub – Manage cryptographic keys and user identities

#66

Post by ibejoeb »

feanaro wrote: post #53
ibejoeb wrote: post #40

Earlier quoted context omitted.

The problem with that is that it completely disregards one market, i.e., the one that wants an integrated system. You could probably install six programs that do these individual things, but then you'd have to install six programs. That's a non-starter for those looking for the integrated solution.

What if you made a unified installer that installs those six tools configured in a certain default way?

Certainly there are plenty programs that are designed modularly, componentized, plugin-based, compositional, whatever... They just never feel as good as purpose-built apps with good workflows. If you know of one that does, please do forward it on because I'd love the inspiration.

I think Keybase does what it intends to do, which is to make PKI accessible to non-experts and to cultivate a community of users achieve the usefulness that network effect affords.

If you're really just looking for encryption and signing, encrypted filesystems, encrypted chat, distributed filesystems, and you're an expert, you have the tools you need.

Re: Keys.pub – Manage cryptographic keys and user identities

#67

Post by asdkhadsj »

ibejoeb wrote: post #66
feanaro wrote: post #53

Earlier quoted context omitted.

What if you made a unified installer that installs those six tools configured in a certain default way?

Certainly there are plenty programs that are designed modularly, componentized, plugin-based, compositional, whatever... They just never feel as good as purpose-built apps with good workflows. If you know of one that does, please do forward it on because I'd love the inspiration. I think Keybase does what it intends to do, which is to make PKI accessible to non-experts and to cultivate a community of users achieve th…

> They just never feel as good as purpose-built apps with good workflows. If you know of one that does, please do forward it on because I'd love the inspiration.

I think the flaw here is that you're (likely) comparing purpose-built with unrelated unix-like apps.

What could have been done here with Keybase, is a purpose built app composed of unix-like tools, all controlled and implemented towards the purpose-built app. Aka the IM would be unique if you wanted it, or bundled with the FS, but both would be first-class Keybase citizens.

Unfortunately most companies don't put the time or effort into letting people consume parts of their offerings. It's all or nothing. Which is the complaint here, imo.

Re: Keys.pub – Manage cryptographic keys and user identities

#68

Post by philsnow »

jadbox wrote: post #34

What does this wormhole exactly do? The docs just say it's a secure connection, but how exactly do you interact with it?

it's https://github.com/warner/magic-wormhole

but see in particular https://github.com/warner/magic-wormhole/issues/107 . It uses a static wordlist and by default uses a shared pool of rendezvous servers.

The (an?) author addresses this here https://magic-wormhole.readthedocs.io/en/latest/attacks.html but I think characterizes the attack poorly: it's not important that it's low-probability that an attacker can pull off a MitM transparently, all an attacker needs to do is be able to guess the channel + code words before the receiver receives the message. The default is to only use two code words, so 65536 possibilities. I don't think it would be hard to open 64k connections very quickly, so this seems like an easy-to-win race. Maybe I misunderstand the math.

I don't think wormhole should be used for anything important without a private rendesvous server, and if you have secure access to a private rendezvous server, why bother with wormhole?

Re: Keys.pub – Manage cryptographic keys and user identities

#69

Post by grizzles »

gbriel wrote: post #43

Hi all, I'm the author of keys.pub. Can the mods change the title of this post at all? This project is meant to be supportive of ideas from Keybase and to promote Saltpack and this title is weirdly disparaging. (Edit: Title was changed, thanks!) Thanks everyone for the feedback. This project is in its early stages but the goal is to make it easier to manage and securely store keys and secrets. I'm currently working o…

You're right - Key Management is (very) hard. It looks like you have some nice primitives there, personally I'd love to see you take a few weeks to discuss /gather feedback and refine your plans before copying the flawed Keybase approach wholly. I'm especially skeptical of the idea of linking 3rd party accounts into a global identity descriptor. Iirc there's also been some good Keybase criticism in previous HN threads.

Re: Keys.pub – Manage cryptographic keys and user identities

#70

Post by rakoo »

Sidnicious wrote: post #29

This loses something important about Keybase sigchains: on Keybase, a sigchain represents an identity and not a single key, which makes it possible to add separate keys for different devices and to seamlessly replace and revoke keys over time. (Non-key-specific sigchains let the Keybase client do interesting things like automatically re-encrypting shared data when someone revokes an old key.) Tying sigchains to keys…

Indeed, in a perfect UX you'd never manipulate keys, always identities; that gives keys less importance and allow them to be rotated in a period that's closer to 10 weeks than 10 years. Also, exchanges are done with identities, not keys.
Post reply on HN