Hacker News Reader

Comment by DenseComet | Hacker News Reader

It's unfortunate that they bought and destroyed Keybase [1] in a bid to improve their security and even still there seems to be no improvement. Guess even the best folks can't make an impact if company culture prevents it.

[1] https://github.com/keybase/client/graphs/commit-activity

View on HN

Same, they were my preferred platform for secure messaging, which is bizarre when you think about the fact that this wasn't even their original purpose. I guess this was indicative of the general lack of a single defined direction the product was going in near the time of the Zoom acquisition. What a shame. Hopefully someone makes something similar.

What killed me was I was ready to pay for any features like storage. They just never bothered. I wish they hadnt bought it out and instead just hired their team as consultants... This is a darn shame.

What was the draw of Keybase? I wasn't interested when it was a "post all your website usernames here, but with crypto somehow" site, and by the time I looked in on it later, it was an unreadable startup homepage and had some kind of cryptocurrency scam attached to it. If it had a good messaging featureset that should be cloned, former Keybase users should speak up!

It had excellent chat functionality that worked well, and this was at a time in which the Signal client for Android was still quite buggy (hundreds of Bad encrypted message messages flooding group chats, messages delivered hours late and all at once, poor performance etc.) My group naturally gravitated towards Keybase as our secure messaging platform. The other killer feature was KBFS, which was a sort of shared encrypted filesystem with which you could sync files securely across all of your devices, share files publicly or with specific users or sets of users or groups in cryptographically protected ways.

The unintelligible foray into cryptocurrency with Lumens made very little sense to me, but apparently the coins I was gifted for free by Keybase are worth over 100 USD now. I'll probably hold on to them.

FYI, if you want to liquidate those, AnchorUSD makes it really easy to transfer them out to a US bank account.

Thanks for the heads up :)

I use the keybase git repo to store my dotfiles. It's quite nice but I'm moving to my own git server instead.

For me Keybase was a place to collect my public internet profiles in one place, with cryptographic auth that it's actually me.

All the chat, team, storage and crypto crap was just superfluous for me.

As someone who occasionally needed to share secrets (auth keys etc) with colleagues, or encrypt the odd file, it was really useful, it made all those things a lot easier.

Unfortunatly all that extra stuff they piled on top seems to have distracted from just making the basics great.

> https://github.com/keybase/client/graphs/commit-activity

Thats an awesome graph. Pretty hard to hide or fake activity on an opensource project.

Also it shows how quickly engineering was pulled off projects... Usually it would be a matter of "finish the PR/feature/bug you're on", which might be days or weeks. Yet here everyone is pulled off over ~3 days.

The activity declined over the course of almost 2 months.

Ahhhh, "Our incredible journey" aka "So long suckers! See you at the yacht club sometime!"

- The code is open source

- It provides all features for free

- It is actually usable

- AFAICT, no reports of security breaches

- No privacy violations

- At one point, they actually GAVE free lumens to its users. No strings attached at all. I received ~40USD worth of XLM which I transferred to an exchange and sold it right away.

Please explain to me. again: how did they make you a sucker of you or their users?

Is server side open source?

Right, I meant the client - where it would be easier to claim malice or ill-intent from the company.

> ...in a bid to improve their security

Not specific to Keybase, but a lot of "cyber security firms" these days base their entire business on gross violations of privacy, unfortunately.

What?

They're not wrong. A large amount of the basically exist off gross privacy violations. Fingerprinting, gross PII sharing and overstorage, port scanning users' computers and LAN from their browser behind the FW/NAT for "security purposes",

Maybe we're thinking of cyber security as different things, I'm mostly thinking about application security and enterprise security? What are you talking about?

anti-scraping, l7 ddos/bot/spider prevention, "anti fraud", fingerprinting devices on login, port scanning devices on login, this is pretty common in application and enterprise

Yeah this was so sad, but I'm happy the guys that made it got paid. Even they would have known this was the end for Keybase. Hopefully when their non-compete clauses end the developers will make another product the same.

< Hopefully when their non-compete clauses end the developers will make another product the same.

... and it will get saddled with the reputation for trustworthiness it deserves. Sell me out once, shame on me...

> Yeah this was so sad, but I'm happy the guys that made it got paid.

I don't really sympathize with this. You build something, get a ton of people to use it, advocate for it, get their friends to use it... I think after that, you have a responsibility to those users, and selling to a company like Zoom and then peaceing out on further work does not fulfill that responsibility.

I couldn't disagree more. Most users didn't even pay, for goodness' sake.

Was there a choice to pay??

ok that's my bad - i thought they had an paid enterprise plan. So actually _nobody_ paid. That makes me believe even more strongly that the founders do not owe users anything.

It's a shame you feel that way; personally I feel that avoiding responsibility for your actions toward others is one of the big ills in our society. Suggesting that there's only responsibility if money changes hands merely makes me sadder.

If you decide to base your business model on unpaid users, that doesn't absolve you of responsibility for them. You're still getting something from them, whether it's user numbers that impress prospective investors, or usage data that you can sell to third parties, or whatever.

If you're building a security- and privacy-focused product, selling it to a company that has demonstrated several times that they don't care about their users' security or privacy is unethical, regardless of how you slice it. It makes the world poorer, and the internet less safe for the people who use it. This has nothing to do with payment.

The choice is entirely with the consumer to decide to use non free software. Don’t be shocked when you are hurt

The Problem of that they don't want to be secure in the sense you used.

They made it pretty clear that security is for them not a fundamental aspect of their service but an afterthought they have to follow because they would use customers elsewise.

I.e. security is still one of the lowest prioritise for them and only a priority art all because of public pressure

Speaking of Keybase, I'm looking for an alternative to their encrypted Git repositories.

Any suggestions?

Reply on news.ycombinator.com