Hacker News Reader

Comment by rvz | Hacker News Reader

> Ultimately Keybase's future is in Zoom's hands

Well, that definitely translates to uncertainty and ultimately the death of Keybase.

from Zoom's twitter:

"We are excited to integrate Keybase’s team into the Zoom family to help us build end-to-end encryption that can reach current Zoom scalability."

not a word about what happens to the existing technology which doesn't sound very reassuring to existing keybase users.

This is a good point. As far as I understood, Keybase's main offering, i.e. key discovery for accounts you knew little about, was never about "the best crypto that scales to Zoom levels".

Though what the main features were got very muddled anyways, especially with the odd Stellar cryptocurrency wallet implementation. I'm very interested to see what they do with the existing tech, or whether there will be open-source forks that are somehow compatible.

@Keybase users: Check if you uploaded your private key. I hope it is rare but now is the time to make that non existent.

I essentially didn't have a private key prior to Keybase, and I think it's still the only place I use it, so I'll end up rolling a new one if Keybase becomes fundamentally untrustworthy.

They are fundamentally untrustworthy. They haven't taken security issues in the past very seriously, they also have ties to China.

That’s Zoom. Post acquisition Keybase is tied to some of those, but not all. Their dev team is not going to move to China (at least not immediately) and past security issues in Zoom are no indication of Keybase safety.

This will possibly change over time though.

I signed up so long ago that I'm not quite sure what you mean. I remember posting a bunch of public keys (like on my profile here). I think the keybase app generated them along with a private key but it has been like three years.

I don't remember at all uploading one or where to find it if I did, can you explain the issue you have in mind a little more?

The issue is a third-party having control of your private key.

You can optionally have Keybase (generate and) store your private key for you.

It's designed to lower the barrier to entry, but is obviously less secure than managing it yourself outside of Keybase (e.g. in GPG keyring, or a physical OpenPGP smartcard such as a Yubikey) - and some consequently wish the storage had never even been offered.

That optional GPG/PGP private key storage was also re-hidden (and almost but not quite removed) functionality by Keybase over the course of the application's life as they moved away from using traditional GPG/PGP-style keys to a more complicated but more secure system based on device-specific keys (and chains/webs of those keys and their derivatives), around when you needed another device to onboard the next device rather than just needing to sign in with username/password.

https://github.com/keybase/keybase-issues/issues/160

There is still (apparently under another command name) this ability to upload your private key.

I saw that coming when they shoehorned a pointless cryptocurrency that nobody uses into it.

It was actually a really nice stellar wallet implementation. A bad bet perhaps, in hindsight. Unfortunately, this acquisition means I won’t be using it anymore for the foreseeable future.

It looked like a de-anonymization attack and brought phishing attacks to crypto groups using Keybase group chat.

It was badly implemented, badly introduced, and harmful for both users and adoption of the platform.

Keybase was always a de-anonymization platform, and there have always been spam/phishing concerns for the platform. The crypto wallet was a dumb way to force them to address some of the spam/phishing/harassment issues inherent in the platform as a "social media" with ties to nearly every other social media through its validation checks, but it was past time needed for spam/phishing/harassment control (as some minorities had said for years prior to the crypto wallet forcing such things).

I deleted my account when the crypto-spam emails started to arrive.

Reply on news.ycombinator.com