Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Keybase raises $10.8M

keybase.io

Post reply on HN
Print view View original

81–90 of 126 posts

Re: Keybase raises $10.8M

#81

Post by cpach »

kajecounterhack wrote: post #38
pjlegato wrote: post #26

The fatal problem with this plan is that all end user devices are by now hopelessly compromised. Take a look at the Snowden documents, which are now years behind the state of the art. It doesn't matter if your crypto is both bulletproof and easy to use. They'll just break into your phone or your laptop through a side channel and read the key. And you won't even notice.

Agreed. Cool EM side-channel attack published March this year: http://eprint.iacr.org/2015/170.pdf

That stuff is spooky. But I don’t think it’s usage is widespread.

Re: Keybase raises $10.8M

#82

Post by sjustinas »

malgorithms wrote: post #17
chrisfosterelli wrote: post #14

> The Node reference client to our PGP directory will be retired. (PGP support will continue, of course.) Can anyone from Keybase shed light on the reasoning behind this? It sounds like you are moving away from programmer-friendly API libraries and into GUI apps. Even if they're open source, as a developer I really liked your up-front API. Will you still be providing those APIs?

Oh, a clarification: the Node client will be replaced by the Go version. The `keybase` command line app will be a superset of what's available in the Node client now. Sorry. So yeah - still providing those API's. PGP support will continue, always, it's just that you won't need to have PGP on all your devices -- just the ones you use PGP on. Your PGP key will be part of a family of keys you're known by. If you install…

I'm really excited to see a (relatively) large and complex desktop application being written in Go. Waiting for it to go public!

Re: Keybase raises $10.8M

#83

Post by kajecounterhack »

cpach wrote: post #39
pjlegato wrote: post #33

Earlier quoted context omitted.

This sort of thing may have been limited to powerful state actors a few years ago, but now Pandora's Box has been opened. Many other actors are now actively exploiting the holes deliberately created in the entire stack of computer security infrastructure over the past 20 years by those state actors. It's far more likely that you'll run into someone trying to steal your credit card than an intelligence agency, but the…

So the only resort then I guess is to abandon computers and only use cash and pen and paper.

Nobody's saying that. I think what's being said here is just that we need to fix what's broken. Acknowledging that your physical devices have side channels is important.

Re: Keybase raises $10.8M

#85

Post by kajecounterhack »

cpach wrote: post #81
kajecounterhack wrote: post #38

Earlier quoted context omitted.

Agreed. Cool EM side-channel attack published March this year: http://eprint.iacr.org/2015/170.pdf

That stuff is spooky. But I don’t think it’s usage is widespread.

Yeah, this is true. But the OP still has a point, if we want true privacy there need to be changes at the hardware level.

Re: Keybase raises $10.8M

#86

Post by chinathrow »

jamwt wrote: post #74
chinathrow wrote: post #71

Why the invite thing? Really? Why shorten artificially on who you let in?

Referral trees let you control abuse; if someone suddenly spawns lots of accounts via nested referrals for abuse, you can just cleave off the appropriate subtree.

Really? How can they publicly state that they promote security and open source tools while denying anyone access who like to use the service?

Re: Keybase raises $10.8M

#88

Post by VLM »

tghw wrote: post #65
irq-1 wrote: post #50

Keybase is the wrong way to do a PKI directory. First, people should have multiple keys/identities by default; multiple identities should be the normal thing everyone does. Single identities will be used by governments to control people. They'll also work against normal communication patterns where people speak differently to different groups (think parents, friends, coworkers.) Second, matching a name with social me…

1. You can set up multiple Keybase accounts if this is an issue for you. It doesn't seem like that much of a problem. 2. Most people do put enough personally identifiable information on their social media accounts. If you don't want to, that's fine, but you'll have to find some other way to identify yourself to people who you want to use your public key. 3. You can have Keybase manage it for you, if you want. Yes, of…

Note that recent .gov data breaches now show in public what we already knew, that once someone has your private data (like private key) then everyone has it eventually, except perhaps for the general public, for a limited time.

This insight factors into another criticism of ops list of problems. IF we lived in a world where all data wasn't shared and merged, then this could be used as a tool to help FB and twitter and .gov do a merge. But we can assume the merge has already happened and the data is near perfect. Therefore the sole remaining benefit of not putting PII into social media etc is the general public / private citizens have no idea who I am so they can't send me secure email. This sounds fairly useless, if every .gov and .com and criminal with a copy of breached data know exactly who I am and who my accounts are.

You see there's been an inversion in security, that some people can see and some people cannot yet see, future being unevenly distributed and all that. If we didn't live in a total surveillance Orwell society, then a tool to make it microscopically easier to connect the dots would be bad despite its good parts, but given Big Brother's infallibility, eliminating the tool because it might help (infallible) Big Brother in a very small way that BB doesn't need anyway, only eliminates the small amount of known positive that the tool does provide.

I have a keybase account and its pretty awesome and well implemented. Cool! I never use it because the use case of randomly sending encrypted stuff to people I don't already know doesn't come up very often. But if I had to, it is pretty slick...

Re: Keybase raises $10.8M

#89

Post by chinathrow »

I just looked at the source of the page:

A) external CSS which might leak about a visitor to Google

B) 

       No Google Analytics or other 3rd party hosted script tags on Keybase.

       And this has the added bonus that we'll never be able to serve ad code.

                         \o/   \o/
                        chris  max

  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~-->
No 3rd party JS: good.

Still leaking visitor info: bad.

Re: Keybase raises $10.8M

#90

Post by malgorithms »

chinathrow wrote: post #89

I just looked at the source of the page: A) external CSS which might leak about a visitor to Google B) No Google Analytics or other 3rd party hosted script tags on Keybase. And this has the added bonus that we'll never be able to serve ad code. \o/ \o/ chris max ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~--> No 3rd party JS: good. Still leaking visitor info: bad.

hah, I forgot about that note.

Good point - our stance was to protect from targeted code injections (by a coerced or hacked Google). But of course you're right, there's no point letting Google know at all.

I've made an issue to move font/css hosting off Google.

Post reply on HN