Keybase is out for iPhone, Android • Hacker News Board

Re: Keybase is out for iPhone, Android

#91

Post by insomniacity » Fri, May 12, 2017, 7:43 AM UTC

Pamar wrote: post #45

malgorithms wrote: post #8

Oh HN, so much for a soft-launch! (But thanks for all the positive comments on here.) We've been testing Keybase a lot with iOS and Android testers and we quietly released into the app stores last night. In many ways it's an MVP focusing on: (1) Keybase chat, and technically important (2) your phone acting as an additional device key, so you can easily provision new desktop computers. There are still some things miss…

Any chance to be able to prove also my own Google+ profile?

Take a look at https://github.com/keybase/keybase-issues/issues/518

Re: Keybase is out for iPhone, Android

#92

Post by activis » Fri, May 12, 2017, 7:47 AM UTC

sebsauvage wrote: post #42

activis wrote: post #35

Earlier quoted context omitted.

As I read France set very troublesome restrictions for any software which uses cryptography. As I remember it requires some kind of approval from government, assignment of special code based on documents you provide via mail. And it takes up to 4 month.

Signal, Telegram, WhatsApp, PGP, RetroShare and other are freely available in France. Most notably PGP has been available in France for decade and has never received any form of approval as far as I know.

It's not about being available on the internet, it's about being available on the AppStore or Google Play Market which make you comply with French laws.

Just read developer FAQ for the store you want, there is a requirement of "Declaration approval from French ANSSI authorities." which links to http://www.ssi.gouv.fr/en/regulation/cryptology/

"...

However supplying, importing and exporting cryptology means in and from France are regulated activities. These operations are either subject to a declaration or an authorisation process.

ANSSI records declarations and investigates requests for the authorization of cryptology equipment and services in accordance with French and European Community legislation."

So you have to send them ANSSI declaration and get an approval to submit an app to the store.

If you are distributing something through the website which is available everywhere then you can ignore that since there is no entity which would control that you follow French law, but it just a technical details. The law is the same for everyone I believe.

Regarding Telegram, Signal, WhatsApp, etc.: I believe they have sent all the documents and got the permission/registration in all regions they are available in and which require that.

Re: Keybase is out for iPhone, Android

#93

Post by activis » Fri, May 12, 2017, 7:48 AM UTC

jwfxpr wrote: post #77

activis wrote: post #35

Earlier quoted context omitted.

As I read France set very troublesome restrictions for any software which uses cryptography. As I remember it requires some kind of approval from government, assignment of special code based on documents you provide via mail. And it takes up to 4 month.

France has removed those restrictions, since 2004. https://en.wikipedia.org/wiki/Cryptography_law#France

Just check out http://www.ssi.gouv.fr/en/regulation/cryptology/

"...

However supplying, importing and exporting cryptology means in and from France are regulated activities. These operations are either subject to a declaration or an authorisation process.

ANSSI records declarations and investigates requests for the authorisation of cryptology equipment and services in accordance with French and European Community legislation. "

Re: Keybase is out for iPhone, Android

#94

Post by activis » Fri, May 12, 2017, 7:50 AM UTC

sebsauvage wrote: post #44

activis wrote: post #35

Earlier quoted context omitted.

As I read France set very troublesome restrictions for any software which uses cryptography. As I remember it requires some kind of approval from government, assignment of special code based on documents you provide via mail. And it takes up to 4 month.

And Keybase desktop apps are freely downloadable from French IPs, so... ?

Keybase desktop apps are not distributed through AppStore or Google Play Market, so there is no one to make them follow French law at that point. While stores should comply and make developers follow all the procedures.

Re: Keybase is out for iPhone, Android

#95

Post by activis » Fri, May 12, 2017, 7:52 AM UTC

roblabla wrote: post #59

activis wrote: post #35

Earlier quoted context omitted.

As I read France set very troublesome restrictions for any software which uses cryptography. As I remember it requires some kind of approval from government, assignment of special code based on documents you provide via mail. And it takes up to 4 month.

Source ? I'm french, and I've never heard of this. US used to have silly export laws way back when, but that's been over since 2000.

http://www.ssi.gouv.fr/en/regulation/cryptology/

Big app stores like AppStore or Google Play Market make you comply with the law every time you submit an app with cryptography inside.

Re: Keybase is out for iPhone, Android

#96

Post by BjoernKW » Fri, May 12, 2017, 7:55 AM UTC

The paper key process after the initial login is broken.

Because I didn't have an actual piece of paper with me when I tried the app (and writing down things like that on paper is a weird idea anyway) I opened 1Password to create a secure note there. Unfortunately, when I returned to Keybase the app had already silently moved on to the next screen without me having confirmed anything.

I'm not sure what this paper key will be needed for in the future but I hope it's nothing important.

Re: Keybase is out for iPhone, Android

#97

Post by pjc50 » Fri, May 12, 2017, 9:28 AM UTC

Hmm. Could I use the file storage feature of this to store small text files containing passwords and other confidential data? Would that fit well with its security model?

Re: Keybase is out for iPhone, Android

#98

Post by robinson-wall » Fri, May 12, 2017, 10:09 AM UTC

malgorithms wrote: post #32

rtkwe wrote: post #29

Earlier quoted context omitted.

They have a blog post of their key model. [0] If you lose your device you shouldn't have to re-prove your identity on all services just any that you proved using that particular key. [0] https://keybase.io/blog/keybase-new-key-model

Almost 100% correct :-) First part: if you lose or wipe a phone and want to reprovision, the lost device's private key is GONE. It will not exist in some icloud backup. When you provision your new device, the Keybase app will make fresh keys. To make that device yours, you'll need to either (a) bring together another keybase device, or (b) enter a paper key. When you do that, the old key will sign your newly generate…

Can I confirm my understanding? In my graph https://keybase.io/nickrw/graph if I lost the key "panya" I would still be able to use either of my other two device keys to add another device, even though they are child nodes?

Re: Keybase is out for iPhone, Android

#99

Post by malgorithms » Fri, May 12, 2017, 10:24 AM UTC

robinson-wall wrote: post #98

malgorithms wrote: post #32

Earlier quoted context omitted.

Almost 100% correct :-) First part: if you lose or wipe a phone and want to reprovision, the lost device's private key is GONE. It will not exist in some icloud backup. When you provision your new device, the Keybase app will make fresh keys. To make that device yours, you'll need to either (a) bring together another keybase device, or (b) enter a paper key. When you do that, the old key will sign your newly generate…

Can I confirm my understanding? In my graph https://keybase.io/nickrw/graph if I lost the key "panya" I would still be able to use either of my other two device keys to add another device, even though they are child nodes?

yup!

Re: Keybase is out for iPhone, Android

#100

Post by malgorithms » Fri, May 12, 2017, 10:27 AM UTC

azag0 wrote: post #48

malgorithms wrote: post #32

Earlier quoted context omitted.

Almost 100% correct :-) First part: if you lose or wipe a phone and want to reprovision, the lost device's private key is GONE. It will not exist in some icloud backup. When you provision your new device, the Keybase app will make fresh keys. To make that device yours, you'll need to either (a) bring together another keybase device, or (b) enter a paper key. When you do that, the old key will sign your newly generate…

Re the final point: Was it like this from the beginning? I still have some identities signed by my original PGP key with which I signed up to Keybase https://keybase.io/azag0/graph

yes, but to be clear: an identity proven by your PGP key is still considered "you" for chat/KBFS, as your device keys have transitively said that PGP key is you. So (1) PGP proved twitter (or whatever), then (2) PGP signed in a device key (which counter-signed), and therefore (3) device key can read KBFS/chat that is sent to you by your Twitter name.