Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase.io

keybase.io

Post reply on HN
Print view View original

71–80 of 125 posts

Re: Keybase.io

#71

Post by bascule »

sweis wrote: post #25
malgorithms wrote: post #8

Hi everyone, Chris here, I've been working with Max on Keybase. I can't help but feel this ended up scooped a bit early. (Crap!) Not a surprise, because HN is quick. The alpha site's changing every day, and we're working on the documentation now. I don't use the term "alpha" loosely. There will be extensive security details published, explaining every aspect of the identity proof system, client sessions, etc. They wi…

Even though there is a disclaimer, I think the "encrypt in your browser" feature ( https://keybase.io/encrypt ) undermines Keybase's security credibility. This form has essentially the same level of security as Hushmail. Anybody using it should consider the content exposed to Keybase or anyone compromising Keybase.

Yes, you are correct. Unless browser extensions are used (and even then) the web is not a good platform for cryptography. The web is a platform for letting a potential attacker run untrusted code on your computer without all hell breaking loose, not for building trusted cryptography applications:

http://tonyarcieri.com/whats-wrong-with-webcrypto

Re: Keybase.io

#72

Post by sfeng »

I've got to say this site does 'responsive design' the exact wrong way. On small screens all the words are hidden explaining what it actually is, instead you just get a giant meaningless image and buttons with no context.

Re: Keybase.io

#73

Post by Groxx »

malgorithms wrote: post #20
JustARandomGuy wrote: post #11

Earlier quoted context omitted.

Hi Chris, a few comments: 1. I like the site design, the story flow on the front page does a great job of explaining what keybase is. 2. I see (from the abovementioned story flow) that keys can be verified by reviewing signed tweets/gists. Is this functionality extendable to arbitrary links; i.e. verifying keys against personal blogs, Tumblr, WordPress or does the third-party site need to implement a recognized API?…

Good question! There will be no such thing as a general check, because -- for any identity -- the client software has to perform a check that a human would agree means something. For example, what does it mean that you own a certain blog? How would a person confirm it? Well, at first glance it might mean that you have the power to post a message there. But someone else could do that it in a comment, and so that would…

Seems like you could get around that with a meta tag on the claimed site? Meta tags are basically never commenter-editable, and are usually owner-editable, they're basically a perfect fit for this. Alternatively there's a site/.well-known/keybase style URL (I have no idea what the best-practices are for .well-known. Personally I prefer meta tags.)

Obviously Twitter isn't likely to implement either of those, so some high-value custom implementations are still great. But if Maria owns maria.com and can assert it automatically, that's pretty strong supporting evidence.

Re: Keybase.io

#74

Post by chaitanya »

tptacek wrote: post #68
maxtaco wrote: post #47

Earlier quoted context omitted.

I'm not an authority on hushmail, but it seems like they do crypto on the server, and the server is just trusted to throw away the keys and plaintext? In the keybase Web client, all crypto happens on the browser. The server knows no keys or data in plaintext. Of course, you'd have to audit the front-end JS code to believe that claim. But our intention is that the only way to compromise the Web-based tools would be to…

Then the only difference between hushmail and your model is exactly what the FBI will get a subpoena to have you type into your server to subvert your users. The models are equivalently insecure. Incidentally, you can't simply audit the "front-end Javascript"; you have to evaluate everything that influences the Javascript runtime (the DOM, stylesheets, cached resources, &c) every time the page loads . Browsers aren't…

FWIW, I found your post "Javascript Cryptography Considered Harmful" very helpful in understanding problems with client side crypto in the browser. I will recommend it to anyone who thinks it is safe: http://www.matasano.com/articles/javascript-cryptography/

Re: Keybase.io

#78

Post by aidos »

sneak wrote: post #27

I really, really want crypto, specifically, safe and secure-by-default crypto, to become much more usable. Despite this hope, I can't seem to help the fact that the first thing that popped into my head when I read their webpage is "oh, they're wrapping and abstracting important key authentication and critical key trust configuration to make it more user-friendly, and implementing it all in javascript. WHAT COULD POSS…

Honest question, which part of writing it in JS makes it less safe? I understand that running in a browser is an inherently unsafe model because of the various mechanisms that make it impossible to track code that's running along side yours. How is it that JS is unsafe in a server environment?

Re: Keybase.io

#79

Post by fsiefken »

Stealth- wrote: post #17

This is great. Proper cryptography is the solution to so many of the problems the modern internet is facing right now, but the key problem with cryptography is that it is never user friendly enough and never distributed enough. This looks like a great step in the right direction.

What do you think of http://invictus.io/keyhotee.php user friendly and distributed identity

Re: Keybase.io

#80

Post by huhtenberg »

malgorithms wrote: post #8

Hi everyone, Chris here, I've been working with Max on Keybase. I can't help but feel this ended up scooped a bit early. (Crap!) Not a surprise, because HN is quick. The alpha site's changing every day, and we're working on the documentation now. I don't use the term "alpha" loosely. There will be extensive security details published, explaining every aspect of the identity proof system, client sessions, etc. They wi…

Chris, a bit OT, but who made the illustrations for the site? They are incredible.
Post reply on HN