Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase's mission is to make encryption mainstream

observer.com

Post reply on HN
Print view View original

71–80 of 84 posts

Re: Keybase's mission is to make encryption mainstream

#71

Post by cowpig »

malgorithms wrote: post #31
niftich wrote: post #4

A good article that covers what Keybase is, where they came from, what they try to do, and where they're trying to go -- although you couldn't tell from the headline. As in the article body, Slack is namedropped just for effect; Keybase Teams being a decent proof-of-concept of a popular kind of application to show that the ideas behind Keybase can be used to build real products. That being said, Keybase has been movi…

When we started Keybase, it was a hobby project to address shortcomings of PGP. Max and I both had just downloaded software packages and wanted to verify them, and it took us hours. At least one of them was bitcoin; I recall staring in awe as Max showed me the countless Gavin Andresen impostors on the popular PGP key servers. We really thought we'd stick up the Keybase directory, make some basic scripts, and move on.…

Why did you choose to tie identity to devices? That idea has always seemed fundamentally flawed to me, and if it wasn't for this flawed core idea, I would be a big fan of what you are doing.

I am not my cell phone, my laptop, or any other possession. I am a collection of memories and experiences, so it makes perfect sense for my identity to be tied to that--like a passphrase.

This isn't just a philosophical idea. I travel a lot and change cell phones all the time. My laptops break and get stolen. I lose things. But I (almost) always have my mind with me.

Re: Keybase's mission is to make encryption mainstream

#72

Post by asddddd »

koolba wrote: post #14
_mcdougle wrote: post #9

Earlier quoted context omitted.

Always save the keys (or the scanner code) whenever you add them to Authenticator. Then, when you get a new phone (or whatever) you can just re-import the keys.

It's pretty stupid that Google doesn't allow for any way of getting the keys out of it's 2FA app. Your only transition path is backup/restoring an entire device to a newer one of the same OS. There's no direct path to migrate from say an iPhone to an Android based phone without manually adding each 2FA entry to the new device.

If you have a rooted phone, there is another option: copying off the sqlite database. At that point you can generate QR codes with a tool like WinAuth. Bit of a pain, but very doable (if you rooted your phone.)

Bypassing this with Authy is generally a better idea.

Re: Keybase's mission is to make encryption mainstream

#73

Post by dunham »

koolba wrote: post #67
jamesgeck0 wrote: post #64

Earlier quoted context omitted.

> Your only transition path is backup/restoring an entire device to a newer one of the same OS. This isn't an option on iOS! When I bought an iPhone a year and a half ago, the 2FA keys were not included in my iTunes device backup, even through backup encryption was turned on. I had to manually create new keys for all seven sites I use Google Authenticator with.

They're definitely included as I've done it a number of times. I'm going to wager you don't have your iTunes set up to backup apps from your phone. I think there's a separate check box you have to click once to enable it.

The secrets are in the keychain, which is backed up.

Google Authenticator used to store its secrets in the devices keychain as available "while unlocked". This allows them to be stored in the backup in a way that can be transferred to a new device - if you use an encrypted backup. It also makes it possible to extract the keys if you know the backup password. (I have code that does this, inspired by the old "iphone-dataprotection" codebase on google code.)

Google Authenticator now (last I checked) marks its keychain entries as "This device only" - this still allows backup/restore, but only to the same device. They are wrapped by a key only available on that specific device (the 0x835 key - you used to be able to extract it on a jailbroken device, but I'm not sure that's possible anymore).

It's possible you have grandfathered entries or even an old version of Authenticator. But I no longer see entries for "CLNPY5GLN9.com.google.Authenticator" in my decrypted keychain, so it must have migrated my old entries. Before my phone dies, I need to go through all of mine and make sure I've got a backup or regenerate the ones I'm missing. (I have old snapshots of decrypted keychains.)

Re: Keybase's mission is to make encryption mainstream

#74

Post by giancarlostoro »

malgorithms wrote: post #31
niftich wrote: post #4

A good article that covers what Keybase is, where they came from, what they try to do, and where they're trying to go -- although you couldn't tell from the headline. As in the article body, Slack is namedropped just for effect; Keybase Teams being a decent proof-of-concept of a popular kind of application to show that the ideas behind Keybase can be used to build real products. That being said, Keybase has been movi…

When we started Keybase, it was a hobby project to address shortcomings of PGP. Max and I both had just downloaded software packages and wanted to verify them, and it took us hours. At least one of them was bitcoin; I recall staring in awe as Max showed me the countless Gavin Andresen impostors on the popular PGP key servers. We really thought we'd stick up the Keybase directory, make some basic scripts, and move on.…

Honestly hoping to see email support, or an email sub-project that makes using encryption (existing mostly) in email easier. At work we have to use PKI or S/MIME from Microsoft, which only works on Outlook or on Apple's Mail client, why not on some open source client? Why can't I have easy email encryption in 2017 that anyone can use? Aside from just using Protonmail (centralized issues). Glad you guys are doing this project, hoping to buy more space whenever you guys decide to sell more disk space to users.

Re: Keybase's mission is to make encryption mainstream

#75

Post by Jedd »

lysium wrote: post #61

How does keybase make money? I am afraid they are in the business of selling my online identity.

> How does keybase make money? I am afraid they are in the business of selling my online identity.

This comes up semi-regularly. Within the recent announcement of Teams [1] it was noted that:

"Put most simply, we eventually want to find a way for actual enterprises to pay, while keeping personal and community use free. And any use now is grandfathered in."

I've seen similar sentiments in earlier announcements.

They also have a clear privacy policy [2].

[1] https://keybase.io/blog/introducing-keybase-teams

[2] https://keybase.io/docs/privacypolicy

Re: Keybase's mission is to make encryption mainstream

#76

Post by veeti »

philsnow wrote: post #46
scrollaway wrote: post #6

Earlier quoted context omitted.

On Android, I use FreeOTP; I can make backups with `adb`. Separately, I use KeepassXC ( https://keepassxc.org ) and store all my 2fa seeds in a dedicated (separate) 2fa database which I keep locked. You can also keep it in the same database as your password db if you want to trade the 2nd factor for convenience but still get the added benefit of one time passwords.

> I can make backups with `adb` does it follow that an attacker can make a "backup" of your 2fa codes as well, if they get ahold of your phone for a minute or two?

You need to authorize each adb key on the phone, so a screen lock prevents this.

Re: Keybase's mission is to make encryption mainstream

#77

Post by KGIII »

giancarlostoro wrote: post #74
malgorithms wrote: post #31

Earlier quoted context omitted.

When we started Keybase, it was a hobby project to address shortcomings of PGP. Max and I both had just downloaded software packages and wanted to verify them, and it took us hours. At least one of them was bitcoin; I recall staring in awe as Max showed me the countless Gavin Andresen impostors on the popular PGP key servers. We really thought we'd stick up the Keybase directory, make some basic scripts, and move on.…

Honestly hoping to see email support, or an email sub-project that makes using encryption (existing mostly) in email easier. At work we have to use PKI or S/MIME from Microsoft, which only works on Outlook or on Apple's Mail client, why not on some open source client? Why can't I have easy email encryption in 2017 that anyone can use? Aside from just using Protonmail (centralized issues). Glad you guys are doing this…

I have found Enigmail and Thunderbird to be easy and intuitive. Both are open source. Thunderbird is the email client and Enigmail is the plug-in.

Re: Keybase's mission is to make encryption mainstream

#79

Post by snorremd »

KGIII wrote: post #77
giancarlostoro wrote: post #74

Earlier quoted context omitted.

Honestly hoping to see email support, or an email sub-project that makes using encryption (existing mostly) in email easier. At work we have to use PKI or S/MIME from Microsoft, which only works on Outlook or on Apple's Mail client, why not on some open source client? Why can't I have easy email encryption in 2017 that anyone can use? Aside from just using Protonmail (centralized issues). Glad you guys are doing this…

I have found Enigmail and Thunderbird to be easy and intuitive. Both are open source. Thunderbird is the email client and Enigmail is the plug-in.

If your work does not require you to use the proprietary exchange stuff in Outlook I would say that Thunderbird with Enigmail is a really convenient solution for encrypted and signed email. Once set up there is very little overhead involved, and if a recipient's email address is in your local gpg database Enigmail will happily encrypt content by default.

Re: Keybase's mission is to make encryption mainstream

#80

Post by sliken »

KGIII wrote: post #77
giancarlostoro wrote: post #74

Earlier quoted context omitted.

Honestly hoping to see email support, or an email sub-project that makes using encryption (existing mostly) in email easier. At work we have to use PKI or S/MIME from Microsoft, which only works on Outlook or on Apple's Mail client, why not on some open source client? Why can't I have easy email encryption in 2017 that anyone can use? Aside from just using Protonmail (centralized issues). Glad you guys are doing this…

I have found Enigmail and Thunderbird to be easy and intuitive. Both are open source. Thunderbird is the email client and Enigmail is the plug-in.

Now try getting your compute newb friend/family going so they can sign, verify signatures, encrypt, decrypt, add keys, etc.

Now try web of trust, key servers, revoking certs.

Then the finer points of what to when you find tons of different keys for people with the same name.

Then subkeys, short term keys, and keeping long term keys offline.

See.. easy!

Post reply on HN