Comment by mr_puzzled | Hacker News Reader

Comment by mr_puzzled | Hacker News Reader

Has Keybase lost it's way? I thought they were onto something cool and maybe could explore an enterprise play with private chats, filesharing and git for teams or something like that. Basically make money by selling to teams. But Keybase seems to have stagnated, existing apps are still quite buggy, not enough new developments recently. The facepalm moment for me was when they announced they were supported by the Stellar foundation. I lost all hope then and there. I get that you guys are buddies with the Stellar folk, you think Stellar is cool etc but an objective analysis leads to only one answer : don't do it you'll regret. Maybe add it as a feature (stellar integration) but don't go all in. Speaking of Stellar, still no integration after 1 year?? Focus on what you have and start making money. So, what went wrong malgorithms?

(Sorry if this sounds harsh or rude, there's no point in sugar coating the truth. Hopefully the keybase teams reads this criticism and does a little soul searching.)

In a sense keybase is one of the most important projects built right now (that I can think of).

It covers aspects (think pareto principle) of email, linkedin, slack, github, dropbox, whatsapp, online banking and probably more core use cases that I don’t have on top of my mind.

That is now, today. With a decent user experience that keeps getting better (see recent improvements @ user profiles).

=> all of that end-to-end encrypted and delivered in a way that it is accessible and usable and fun with a long-tail of users in mind.

[I have no idea what an equivalent would be right now, not even as combination of multiple separate projects. Think about that.]

> It covers aspects (think pareto principle) of email, linkedin, slack, github, dropbox, whatsapp, online banking and probably more core use cases that I don’t have on top of my mind.

Soooo... A centralized solution for everything? ;)

Exactly... unless the work is open source, they are just another centralized solution. Reminds me of Telegram.

I thought Keybase was open source? Released under the New BSD (3 Clause) License?

The clients are. The platform they all run on top of is centralized, made up its own irresponsibly insecure key handling and crypto protocols, and is proprietary.

They didn't make any of their own security, they use very well established open-source security libraries for everything. Stop spreading FUD.

I have researched their approach in great detail and found design flaws in it like: https://github.com/keybase/keybase-issues/issues/1946

A lot of trust is rooted in their centralized proprietary walled garden API and to make matters worse they actually silently bypass hardware security modules in favor of keys exposed to system memory!

They even encourage users to expose their PGP private keys to their browser and didn't even bother to isolate it to a service worker so browser plugins can't steal it (or just supporting hardware tokens which GPG already did just fine)

Almost everything they do is non standard, not interoperable with anything else, not distributed to keyservers. They are the internet explorer of cryptography.

They did this in the name of UX but it turns out you can have super easy PGP UX AND follow standards as OpenKeychain has demonstrated.

Keybase introduced lock-in and their own protocols for problems that did not at all need them. They are 2 steps forward on UX and one huge backwards step for security.

You have been on this crusade for a long time now and you have posted this link often, I just realized that keybase is not just a GPG replacement and that using it with my smart card is not a good fit and not the problem they want to solve. So I just accepted that and actually tried to figure out what keybase is actually doing and why rather then demanding they do what I initially wanted from it.

They have been focusing on a per-device key system and its not really a gpg front-end. NaCl is a well known library and what they do is based on it. Saltpack is an open library they use and they use other open libraries as well. I happen to like the how the keybase security system works and I think it has advantages over the GPG that I like.

If you don't want to use the evil centralized system at least spamming the same issue every-time Keybase comes up. If Keybase is not the solution you like then just move on with your life.

> Speaking of Stellar, still no integration after 1 year??

There is integration with Stellar in keybase. I can use the app as a stellar wallet and send/receive lumens.

https://u.today/keybase-starts-supporting-stellar-wallets

Keybase's main competitor seems to be Slack. I don't use Slack but I assume that Slack can read all your messages if they want to, so privacy is the main differentiator.

All these little quality-of-life improvements on top of that can only be a good thing, IMHO.

Seems like it, given how shamelessly they are ripping off Slack's UI.

"Sorry if this sounds harsh or rude, there's no point in sugar coating the truth"

You're an idiot if you believe that.

(Still agree?)

I stopped using keybase because it just takes too long to open up the app on keybase and send message on my phone. the desktop client is great, but it's just too slow on mobile.

I wanted to make a more light-weight chat client for desktop but unfortunately their Go library documentation was completely impenetrable as of ~6 months ago.

Try updating your client.

Reply on news.ycombinator.com