Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keys.pub – Manage cryptographic keys and user identities

keys.pub

Post reply on HN
Print view View original

71–80 of 92 posts

Re: Keys.pub – Manage cryptographic keys and user identities

#71

Post by psanford »

philsnow wrote: post #68
jadbox wrote: post #34

What does this wormhole exactly do? The docs just say it's a secure connection, but how exactly do you interact with it?

it's https://github.com/warner/magic-wormhole but see in particular https://github.com/warner/magic-wormhole/issues/107 . It uses a static wordlist and by default uses a shared pool of rendezvous servers. The (an?) author addresses this here https://magic-wormhole.readthedocs.io/en/latest/attacks.html but I think characterizes the attack poorly: it's not important that it's low-probability that an attacker can pull o…

That's not how the protocol works. A single failed guess terminates the connection and alerts the sender that an incorrect code was used and someone might be attacking them.

If you are concerned about guessability you can use more than 2 words. You can also use strings that are not in the default word list (the only thing the default word list gives you is tab completions).

edit: Also the "wormhole" spec that keys.pub has is not related to magic-wormhole.

Re: Keys.pub – Manage cryptographic keys and user identities

#72

Post by yarrel »

everfree wrote: post #42
emanlin wrote: post #33

Earlier quoted context omitted.

Keybase jumped the shark with their crypto coin offering.

I keep hearing people say this, but I don't understand it. It was a fun little giveaway experiment funded by someone else, in the spirit of the company's focus on cryptography. I don't visit the cryptocurrency tab anymore, and it's not like it gets in the way or anything.

It was a trainwreck that damaged the project's reputation and harmed its users.

If you know crypto, it had several problems. There are worse coins to airdrop on your users but not many. The user experience resembled that used by scammers on Telegram and the project's overall behaviour looked like a de-anonymization attack (I mean that seems to be Keybase's business model but this looked exactly like one). All of this led to crypto chats on Keybase being targeted by social engineering attacks, and Keybase's famously bad moderation tools made that much harder to deal with than it could have been.

If you don't know crypto it made Keybase look like a crazy crypto project, which isn't an easy sell.

In either case you could be forgiven for wondering when Keybase got their money transmitter license.

So this did get in the way, and the sooner Keybase remove the tab the sooner it will be clear that they are past the denial stage.

This was a bad enough fuck-up that I removed my social proofs and now recommend that people not use Keybase. But if they fixed a few things (remove the Crypto tab, fix moderation, fix name changes) I'd pay them a subscription in a heartbeat.

Re: Keys.pub – Manage cryptographic keys and user identities

#73

Post by slumos »

everfree wrote: post #42
emanlin wrote: post #33

Earlier quoted context omitted.

Keybase jumped the shark with their crypto coin offering.

I keep hearing people say this, but I don't understand it. It was a fun little giveaway experiment funded by someone else, in the spirit of the company's focus on cryptography. I don't visit the cryptocurrency tab anymore, and it's not like it gets in the way or anything.

I for one didn’t appreciate being spammed by them in the app I only keep running for secure private messages.

Re: Keys.pub – Manage cryptographic keys and user identities

#74

Post by dmvaldman »

Sidnicious wrote: post #29

This loses something important about Keybase sigchains: on Keybase, a sigchain represents an identity and not a single key, which makes it possible to add separate keys for different devices and to seamlessly replace and revoke keys over time. (Non-key-specific sigchains let the Keybase client do interesting things like automatically re-encrypting shared data when someone revokes an old key.) Tying sigchains to keys…

80/20 rule? Make the problem simpler and deliver a better solution for it. Revisit and grow the problem space as needed.

Re: Keys.pub – Manage cryptographic keys and user identities

#75

Post by internalthief »

meddlepal wrote: post #3

One of the killer features for Keybase is the combination of teams + KeybaseFS. Unfortunately this doesn't look like it has either of those features.

Teams + git repositories for secrets is great too.

Makes it less likely that our secrets end up on Github where if Github were hacked, or an web account was hacked that our secrets become public.

Re: Keys.pub – Manage cryptographic keys and user identities

#76

Post by EGreg »

Can anyone suggest a serialization format that can be implemented across languages without being a language lawyer?

JSON seems like it fits the bill but I have seen soooo many complaints about UNICODE encodings, whitespace or some other things, and people saying secure scuttlebutt suxx because it relies on perfectly copying Node’s JSON implementation. But dudes, what format is better out there?

Re: Keys.pub – Manage cryptographic keys and user identities

#77

Post by davidcollantes »

mfrager wrote: post #59
gbriel wrote: post #43

Hi all, I'm the author of keys.pub. Can the mods change the title of this post at all? This project is meant to be supportive of ideas from Keybase and to promote Saltpack and this title is weirdly disparaging. (Edit: Title was changed, thanks!) Thanks everyone for the feedback. This project is in its early stages but the goal is to make it easier to manage and securely store keys and secrets. I'm currently working o…

Your project is very cool. Could you help me fix my account though? I messed up two of the IDs: mfrager@github & mfrager@reddit. Will these be automatically purged from the keys.pub server after a certain amount of time for being invalid?

You can revoke, and generate them again, perhaps?

Re: Keys.pub – Manage cryptographic keys and user identities

#78

Post by philsnow »

psanford wrote: post #71
philsnow wrote: post #68

Earlier quoted context omitted.

it's https://github.com/warner/magic-wormhole but see in particular https://github.com/warner/magic-wormhole/issues/107 . It uses a static wordlist and by default uses a shared pool of rendezvous servers. The (an?) author addresses this here https://magic-wormhole.readthedocs.io/en/latest/attacks.html but I think characterizes the attack poorly: it's not important that it's low-probability that an attacker can pull o…

That's not how the protocol works. A single failed guess terminates the connection and alerts the sender that an incorrect code was used and someone might be attacking them. If you are concerned about guessability you can use more than 2 words. You can also use strings that are not in the default word list (the only thing the default word list gives you is tab completions). edit: Also the "wormhole" spec that keys.pu…

I happily stand corrected on both counts, thanks

Re: Keys.pub – Manage cryptographic keys and user identities

#79

Post by Vendan »

EGreg wrote: post #76

Can anyone suggest a serialization format that can be implemented across languages without being a language lawyer? JSON seems like it fits the bill but I have seen soooo many complaints about UNICODE encodings, whitespace or some other things, and people saying secure scuttlebutt suxx because it relies on perfectly copying Node’s JSON implementation. But dudes, what format is better out there?

The SSB issue with json is that it plays with the json after signing it. Just don't do that.

Re: Keys.pub – Manage cryptographic keys and user identities

#80

Post by mfrager »

davidcollantes wrote: post #77
mfrager wrote: post #59

Earlier quoted context omitted.

Your project is very cool. Could you help me fix my account though? I messed up two of the IDs: mfrager@github & mfrager@reddit. Will these be automatically purged from the keys.pub server after a certain amount of time for being invalid?

You can revoke, and generate them again, perhaps?

I was able to do that, yes.
Post reply on HN