7 ms·

OP here! I had to trim the post down for brevity, but I thought the HN community in particular might be interested in the API side of things. Undocumented in t

OP here! I had to trim the post down for brevity, but I thought the HN community in particular might be interested in the API side of things. Undocumented in the post: you can invent channels for app-to-app communication from the JSON API. For example, it's possible with Keybase chat to have a program posting encrypted messages for another person or program, without cluttering up the visual chat interface. Also - to test chat we've cut the invitation requirement. You should be able to try the app without anyone inviting you.

rebase 10y ago
Firstly, thank you so much! Secondly, I think this is incredibly important moving forward with the proliferation of messaging channels. I want to be able to use one program for all of my different chat sessions. Whether that be adium or pidgin or mIRC or even weechat/bitlebee in a docker container. It would be great if there would be common plugins for common chat clients provided off the shelf. :D
- malgorithms 10y ago
  We didn't design Keybase's chat API to match any messaging standard, but the number of calls into it are very few and flexible, and we're open to change. As it is right now, I imagine it would be very easy to write a library that acts as a bridge to other interfaces, if that's of interest. There are calls to see into your "inbox" which is the set of conversations, read messages, even peek at unread messages. And of course send messages, too.
  - derefr 10y ago
    Two approaches that could get you very far without O(N) effort: • a Matrix gateway server • a libpurple plugin
coldpie 10y ago
This is cool. One thing that keeps me from using Slack, &c is that I don't trust my information to be stored on their servers. Keybase's combination of private keys and open source tools and protocols makes me comfortable with your server-side storage. Your post does a good job describing what is stored in a readable format on your servers. One thing I didn't understand is where the data sent to users not yet on Keybase is stored. It sounds like my client is responsible for storing this unsent message, either locally or on Keybase's server encrypted for myself, and occasionally querying the DB to see if the target user exists and re-encrypting it. Is that right? Finally, any thoughts on spam prevention for this protocol?
- malgorithms 10y ago
  oh, great question! I wish I'd been clearer in the post. Encrypted messages waiting for others are stored on Keybase servers. But they're encrypted only for the sender. The important requirement of this protocol is the removal of extra human steps, especially the ones before composing a message. The only thing a person should have to do is (a) write a message and (b) maybe tell the recipient it's waiting for them on keybase. It's the worst to ask someone for their number or email before you get to compose a message. There are still computer steps, however, and Keybae hides them from you. If you post an encrypted message for foo@reddit, then you sign a statement to yourself that foo@reddit is an intended recipient. When foo@reddit proves herself by announcing a key, your own client verifies the announcement and rekeys the content for her, assuming her key proof matches your signed assertion. This is no work for you, although it does require that one of your devices comes online. If they try to get to the content and all of your devices are off, they'll see a message that the original sender needs to come online before it's available for the first time. The story with phones will be even better, as they're easier to reach through push notifications. As with most large data encryption, this is performed by rekeying a symmetric key. So you can leave a huge attachment for foo@reddit and you don't have to download/upload the data all over again just to make it available. As for spam prevention...we're still discussing. We obviously don't have the ability to study message contents. At the very least, we will need to have easy/clear blocking features
  - coldpie 10y ago
    > Keybae I hope this is an internal nickname ;) Thanks for expanding, and I wish you luck on the spam prevention. We often have conversations in the office about implementing a cost-based anti-spam system[1] for email, but I think a lack of universal usage kills that idea before it can begin. Keybase may be in a position to implement it before the protocol and user interfaces have ossified. Something to think about. I find this stuff fascinating. Deciding not to interview with you guys because I didn't want to move remains one of the biggest "what if"s of my career so far :) [1] https://en.wikipedia.org/wiki/Cost-based_anti-spam_systems https://en.wikipedia.org/wiki/Cost-based_anti-spam_systems
  - po 10y ago
timlod 10y ago
I just installed the app but still get asked for an invitation code. The chat sounds great, looking forward to try it out! edit: Nevermind, on the website I wasn't asked.
lhnz 10y ago
> Undocumented in the post: you can invent channels > for app-to-app communication from the JSON API. Is everything accessible from the JSON API? Like, say I wanted to create a mashup of GitHub and Keybase, could I do so?
- arxpoetica 10y ago
  DO. IT.
oddevan 10y ago
This is really cool. Question: right now, I have a [deep link to Keybase's encrypt page][1] on my website as "Create encrypted message." Will there be a way to do something similar, but using Keybase Chat(tm)? ("build it yourself" is an acceptable answer in this instance) [1]: https://keybase.io/encrypt#oddevan https://keybase.io/encrypt#oddevan
- nannal 10y ago
  -----BEGIN PGP MESSAGE----- Version: Keybase OpenPGP v2.0.62 Comment: https://keybase.io/crypto https://keybase.io/crypto wcBMA+CNQSDgk7JsAQf/bOJdpfJ6Uzt2/dwlQrgYnOOEFVDoFnMYpLDU3R41U4EI vG5CuW3BtpUZyQI+W/sgVXJoaj/HHtc4H+Kj3lqDizdUBansIYBbjtMZaJ/hN/cm zNIa6NlUZqmGKOYt0CKJhINnTp0dQJeVlKJQHjOBwvaqpPw0jfYLqLwfkR5y55RO ++WwyHSLXHQYTd6vX/CYtVAYIEU8NiP3s/FraLtYSF1OWMDITV22vyw5NSg9BLiK SI2vL74hKT5W8AvMBWdMIbFvlC6ef5e8BXABPLVXUtxuHg9t/uCM5ZQ6gnegn54R K39EA4bOwWuCE5XJK1h2RfCB6k8FG7nl9SpjTU6GW8HBTAMv22o+4yM4xAEQAIVZ Szs2mKfbkMKoR1jr6lTvfjm3wpd95ykOMZtKNd1YPPjqbGpAVii/SPqlTMwsgaj3 uuGSZlIQMcjUB/QixaeJowddBQxZzJHS04Cg0t+44MlaVczMe0gE3dyEY8swmKbM OFBq3nPDPuEyFV1LckFUuQwnwfoexvAgzEbW6m6qWt7DR+xKOW6DwkBL2aztWtJc A2s+JBRFw58PY9aeUIku6L0v3+tHLMKAQoXnmwFVA277CpG2OH7sk6rLq85y5JrW fXJ4SuHyIW7mLjYKm9PX6+PhQLH9KzqYlWM+08p/IoXR7DHYSWHRvk7zSruJgHqi I8WJTDdRghfUcbeedQRH8fx7MZiBwLQeHg0kBEEn6ajGr8trbKzdgw82FqPwXIfL 09Df0pcfXhJimfQ8XRVeNPK4+DVHUCEWc4cavm8ZaNSA8r1vRTytNtI3h4eOtM9G FZh/eaxl7hX8KxNGuK0clY+oMshUiNRIVScEUtsgpH8actXSdP16Wv/+H+51Tg9G 8rdNyeRMMBqKn+fDAAQFKbSe7n4GyNcg+dbHFuVzaF1fNq2LbGPOtnKb+Xbfwg0O WMLCui3TXNre30Jv5iorSTNLu3xP9X0LEDWLsgBeqgYW/YFhtwBLjeFUV5lmB4YS UVCDxepIb+yGDHESm9rwb/1Na0kslNPh9/18ngZ40sHBAerxcxFVGav1JBqpModE usf64H3xiBzIyxHbCzPhiSKZjuP2WXNV5k153rCG8bbreTfUXxpO6nIBHT2ie6sA xo7tN66AmN2fouxMIFYERIbL7S5S8fBkO1tsaF+VSveBx2heTQ84k+P4TCVD7PQB IU+TPXg+Vrz15tiVSoSI+Ep+rV2pzKOFQXl0adOUisV8tMMFJD3YSwbUoTreM8tq 7CAyWhCxjnbgiedG1qF/J55WYdNyc9PorK7Kjx6wTRHLVQhF1W80OT8X5gvFbUoe PnzNTp2zi/4hKZfl/8G2tN0VZqhEynCT+iaDO0hG7VVz8DJfDz+9699KpoSVbiad pHiRORulU3/gYKLAYYpOo1fx6AP1utcmDfwEiJEROfZqkMI+CW5HTXGZavr3eImq JhZFsrtSvitXGwcGW6bYDoR56NaV9+A2PUlVt9PrlAonus06tuj2/o47jrdxmX1K aEp3uWVh0ZFSjc2YazmaN/zJyECP7b5Ig2wvhjDh39QqlYPocSZnNnZkWlUi6x3r OQ7ffkqepcFD+Zafm8vU95xs8ehFY+Jivdbbj4P3kff1LBv8NQ6KDKA4eiliDrnO Ml/B1TwipND2PVg8qEq2n64cYJpeGD/Hrcr8PlAvH+v8Xc9VJaerB8yeg9FqyJS7 7dAAkJsgWXBx1bfK6BUkJ/CefNjOYjtizwhVa1uQFOZjpg057WEo0m+dw7nCEG5M 3VexMu/Kx96dI5+hqs6SWSf6rC+Jj74J5cyvtoZZ2XdHl8GzrKt4mHf+XFpqTefG TjwNkYPnofKXfXe/R14wifThs2thVmM6tY5TJBtGdqOVVhJ2wbsbByQ2ivVYBCW3 hAA= =1dpX -----END PGP MESSAGE-----
  - 10y ago
Groxx 10y ago
Q: group chats? Seems like it could be done by encrypting (and sending) the message to all recipients, so it's not particularly efficient, but it's a valuable UI thing.
- mmerickel 10y ago
  If you install the client there is an "i" info button in the upper right of chat that allows you to add participants.
derefr 10y ago
Huh, the channels support is just in time to replace App.net (or maybe "to do App.net right", since it didn't really get off the ground.)
mekaj 10y ago
Thank you and the Keybase team for this. Unlike other services, I think KB has solved the online identity authentication issue. There's one hurdle I need to work through to get going on chat. Thus far I've avoided uploading my private GPG key to my Keybase profile, or even copying it to other devices (call me paranoid). Unfortunately this apparently means I can't authorize any other devices (see error message: http://imgur.com/a/UOftN http://imgur.com/a/UOftN). I assumed device keys were meant to solve this problem, but maybe not. Is there a supported way to make a subkey (GPG or otherwise) of my primary private GPG keypair, so other devices can securely authenticate against my KB profile? EDIT: I haven't yet started using device keys. Maybe they would work?
- NickBusey 10y ago
  This is answered in the FAQ at the bottom of the post. You'll see this policy in action when you install Keybase on a 2nd computer. It'll make you either (a) type something on your first computer, or (b) enter a paper key. This isn't just two-factor auth with server trust. The old key is signing a statement about the new key, and the new key is countersigning.
- philsnow 10y ago
  It could be formatted better: it's telling you you have three different options, one of which is, Install Keybase on a different machine that has your PGP key I was in the same boat as you, I didn't want to import my private key onto this mac laptop because I don't know how the "Keychain.app" works and don't trust apple to not do something super helpful like store my GPG private key forever and always. I did the login flow on the machine I do trust, and was then able to use that machine to authorize the mac laptop, without moving any GPG keys anywhere.
  - mekaj 10y ago
    I interpreted that option as Keybase needing a local copy of the PGP key. Thanks for helping me understand that's not the case. I've set up Keybase on my trusted machine with my GPG keypair, and now have a device key on that machine. When I go to Devices -> Add new... -> New Computer in the GUI I'm told to "Type in text code" (along with the note "In the Keybase app on your computer, go to Devices > Add a new device"). I find this confusing because I'm already there. I tried using the only paper key I have, the one corresponding to my first device key, but there's no response when I click Continue. This is the Linux client, by the way. I'm guessing this is a bug, but I'm not sure. Can you confirm this is the same process you went through to generate your second device key? When I try to log in on the secondary computer, which doesn't have the GPG keypair or a device key, I'm brought to the same error shown in the screenshot.
sisk 10y ago
This is awesome! Thanks! Wondering if you can clarify a bit—what parameters cause a chat to/not to show up in the GUI? Different topics? Different channel names? I have a use for this immediately and am excited to give it a shot!
- malgorithms 10y ago
  For program-to-program talking, use the "dev" channel, in a topic of your choice. (By default --topic-type=chat and changing it to dev keeps it out of the GUI) For example: keybase chat send friend1,friend2\ --topic-type=dev\ --topic-name=KEYBASE-SYSOPS\ "server-restart [reason:hot and bothered]" I'll never see this in the GUI but you and your friend1 and friend2, can access the messages through the chat API. The topic-name can be whatever you want, and it allows you to structure messages into channels. ---- If you're using the JSON api - which makes more sense if you're programming it - take a look at `keybase chat help api` to see some examples of how to structure the JSON going in. Anywhere you see a `channel` object, you can add `topic_type` and `topic_name` to them. Both should be strings.
  - Natanael_L 10y ago
    Why is non-PFS the default? You wrote that somewhere in the documentation. You said something about violating expectations when you sync PFS'd chat contents, but I don't see why that's relevant unless people were promised otherwise. There's nothing about the encryption algorithm itself that dictates how data going over it should be handled at the endpoints. Just let users have a regular mode and an off-the-record mode where nothing is kept. Both PFS protected.
brightball 10y ago
Just installed and it's still asking me for an invite code on the Fedora RPM.
- oconnor663 10y ago
  Could you file an issue over at https://github.com/keybase/client/issues https://github.com/keybase/client/issues and tag @oconnor663 in it please? And maybe include the output of `keybase --version`?
  - brightball 10y ago
    Done.
  - huevosabio 10y ago
    I'm also getting an invite request for macOS
- malgorithms 10y ago
  and for now if anyone hits this, just use the invite code `zcash`. We've left that bypass code working since our recent blog post.
- mutecipher 10y ago
  I had the same issue, but signing up on the website seemed to work fine and then I was able to log in without issue.
kilrathi 10y ago
I was wondering about that very thing when playing with it; encrypted app-to-app comm via the chat. Maybe something similar for the file system with a pair of pipe files.
wazanator 10y ago
Any plans for Steam support?
bootload 10y ago
"it's possible with Keybase chat to have a program posting encrypted messages for another person or program, without cluttering up the visual chat interface." Nice. I'll be looking at what source of tools that use this style of communication on github.
CMay 10y ago
One thing I've noticed so far is that with the Keybase desktop client on Windows 10, the "Reddit Form" button for submitting a proof didn't work for me. It just fails silently and doesn't open a browser window or whatever it's supposed to do. Additionally I am curious why on Reddit people have to post a wall of text, while on Twitter you only have to post a small tweet? Is there some reason people can't just paste the tweet version onto Reddit too?
- thek3nger 10y ago
  Same problem here.
kelnage 10y ago
I'm entirely unconvinced by your argument regarding backing up a perfect forward secrecy chat. PFS is about preventing any listener of the messages in-transit from ever effectively decrypting those messages - it says nothing about security guarantees once the message is received. It'd be like arguing that by enabling PFS also creates a social contract that the receiver guarantees that their device isn't compromised. Or that webservers that use PFS in TLS don't log most/all of the details for the requests they receive. I don't believe either of these to be true. You seem to have extrapolated some social properties from a purely technical property and assumed everyone must think about it in the same way as you. But in doing so, you've made your protocol weaker against realistic attacks. Oh, and the likelihood of an attacker stealing a device with WhatsApp installed and only being able to extract the identity keys and not the cached messages seems absurdly improbable. Personally, I wish you'd either tried to work with OWS/WhatsApp/whoever to integrate in what makes keybase.io great (providing identity verification - something that all these could use) and not gone about adding to the already crowded area of chat providers.
- oconnor663 10y ago
  To be clear, all of Keybase's client-server traffic goes over TLS and benefits from TLS's forward secrecy on the wire.
  - kelnage 10y ago
    I can believe that is the case, but that just moves the attack vector to within Keybase's network, it doesn't mitigate it completely.
  - Natanael_L 10y ago
    Please see this comment: https://news.ycombinator.com/item?id=13605873 https://news.ycombinator.com/item?id=13605873 Nothing stops you from going full PFS. In fact, you could even flip it around and let a shared notepad connected to the chat represent what you want to remember permanently, while the chat could remain ephemeral. This makes for more accurate expectations and less risk of user error.
zapu 10y ago
Oh! And I was wondering whether someone has invited me and I haven't noticed, or if you don't need invitations anymore. Thanks
0xADADA 10y ago
Are ya'll going to post a SHA checksum for the downloadable dmg alongside the download?
- cjbprime 10y ago
  Probably not. It's a TLS connection -- if someone can lie about the contents of the DMG, they can lie about the hash too. How would it help?

rebase 10y ago

Firstly, thank you so much! Secondly, I think this is incredibly important moving forward with the proliferation of messaging channels. I want to be able to use one program for all of my different chat sessions. Whether that be adium or pidgin or mIRC or even weechat/bitlebee in a docker container. It would be great if there would be common plugins for common chat clients provided off the shelf. :D

malgorithms 10y ago
We didn't design Keybase's chat API to match any messaging standard, but the number of calls into it are very few and flexible, and we're open to change. As it is right now, I imagine it would be very easy to write a library that acts as a bridge to other interfaces, if that's of interest. There are calls to see into your "inbox" which is the set of conversations, read messages, even peek at unread messages. And of course send messages, too.
- derefr 10y ago
  Two approaches that could get you very far without O(N) effort: • a Matrix gateway server • a libpurple plugin

coldpie 10y ago

This is cool. One thing that keeps me from using Slack, &c is that I don't trust my information to be stored on their servers. Keybase's combination of private keys and open source tools and protocols makes me comfortable with your server-side storage. Your post does a good job describing what is stored in a readable format on your servers. One thing I didn't understand is where the data sent to users not yet on Keybase is stored. It sounds like my client is responsible for storing this unsent message, either locally or on Keybase's server encrypted for myself, and occasionally querying the DB to see if the target user exists and re-encrypting it. Is that right? Finally, any thoughts on spam prevention for this protocol?

malgorithms 10y ago
oh, great question! I wish I'd been clearer in the post. Encrypted messages waiting for others are stored on Keybase servers. But they're encrypted only for the sender. The important requirement of this protocol is the removal of extra human steps, especially the ones before composing a message. The only thing a person should have to do is (a) write a message and (b) maybe tell the recipient it's waiting for them on keybase. It's the worst to ask someone for their number or email before you get to compose a message. There are still computer steps, however, and Keybae hides them from you. If you post an encrypted message for foo@reddit, then you sign a statement to yourself that foo@reddit is an intended recipient. When foo@reddit proves herself by announcing a key, your own client verifies the announcement and rekeys the content for her, assuming her key proof matches your signed assertion. This is no work for you, although it does require that one of your devices comes online. If they try to get to the content and all of your devices are off, they'll see a message that the original sender needs to come online before it's available for the first time. The story with phones will be even better, as they're easier to reach through push notifications. As with most large data encryption, this is performed by rekeying a symmetric key. So you can leave a huge attachment for foo@reddit and you don't have to download/upload the data all over again just to make it available. As for spam prevention...we're still discussing. We obviously don't have the ability to study message contents. At the very least, we will need to have easy/clear blocking features
- coldpie 10y ago
  > Keybae I hope this is an internal nickname ;) Thanks for expanding, and I wish you luck on the spam prevention. We often have conversations in the office about implementing a cost-based anti-spam system[1] for email, but I think a lack of universal usage kills that idea before it can begin. Keybase may be in a position to implement it before the protocol and user interfaces have ossified. Something to think about. I find this stuff fascinating. Deciding not to interview with you guys because I didn't want to move remains one of the biggest "what if"s of my career so far :) [1] https://en.wikipedia.org/wiki/Cost-based_anti-spam_systems https://en.wikipedia.org/wiki/Cost-based_anti-spam_systems
- po 10y ago

timlod 10y ago

I just installed the app but still get asked for an invitation code. The chat sounds great, looking forward to try it out! edit: Nevermind, on the website I wasn't asked.

lhnz 10y ago

> Undocumented in the post: you can invent channels > for app-to-app communication from the JSON API. Is everything accessible from the JSON API? Like, say I wanted to create a mashup of GitHub and Keybase, could I do so?

arxpoetica 10y ago
DO. IT.

oddevan 10y ago

This is really cool. Question: right now, I have a [deep link to Keybase's encrypt page][1] on my website as "Create encrypted message." Will there be a way to do something similar, but using Keybase Chat(tm)? ("build it yourself" is an acceptable answer in this instance) [1]: https://keybase.io/encrypt#oddevan https://keybase.io/encrypt#oddevan

nannal 10y ago
-----BEGIN PGP MESSAGE----- Version: Keybase OpenPGP v2.0.62 Comment: https://keybase.io/crypto https://keybase.io/crypto wcBMA+CNQSDgk7JsAQf/bOJdpfJ6Uzt2/dwlQrgYnOOEFVDoFnMYpLDU3R41U4EI vG5CuW3BtpUZyQI+W/sgVXJoaj/HHtc4H+Kj3lqDizdUBansIYBbjtMZaJ/hN/cm zNIa6NlUZqmGKOYt0CKJhINnTp0dQJeVlKJQHjOBwvaqpPw0jfYLqLwfkR5y55RO ++WwyHSLXHQYTd6vX/CYtVAYIEU8NiP3s/FraLtYSF1OWMDITV22vyw5NSg9BLiK SI2vL74hKT5W8AvMBWdMIbFvlC6ef5e8BXABPLVXUtxuHg9t/uCM5ZQ6gnegn54R K39EA4bOwWuCE5XJK1h2RfCB6k8FG7nl9SpjTU6GW8HBTAMv22o+4yM4xAEQAIVZ Szs2mKfbkMKoR1jr6lTvfjm3wpd95ykOMZtKNd1YPPjqbGpAVii/SPqlTMwsgaj3 uuGSZlIQMcjUB/QixaeJowddBQxZzJHS04Cg0t+44MlaVczMe0gE3dyEY8swmKbM OFBq3nPDPuEyFV1LckFUuQwnwfoexvAgzEbW6m6qWt7DR+xKOW6DwkBL2aztWtJc A2s+JBRFw58PY9aeUIku6L0v3+tHLMKAQoXnmwFVA277CpG2OH7sk6rLq85y5JrW fXJ4SuHyIW7mLjYKm9PX6+PhQLH9KzqYlWM+08p/IoXR7DHYSWHRvk7zSruJgHqi I8WJTDdRghfUcbeedQRH8fx7MZiBwLQeHg0kBEEn6ajGr8trbKzdgw82FqPwXIfL 09Df0pcfXhJimfQ8XRVeNPK4+DVHUCEWc4cavm8ZaNSA8r1vRTytNtI3h4eOtM9G FZh/eaxl7hX8KxNGuK0clY+oMshUiNRIVScEUtsgpH8actXSdP16Wv/+H+51Tg9G 8rdNyeRMMBqKn+fDAAQFKbSe7n4GyNcg+dbHFuVzaF1fNq2LbGPOtnKb+Xbfwg0O WMLCui3TXNre30Jv5iorSTNLu3xP9X0LEDWLsgBeqgYW/YFhtwBLjeFUV5lmB4YS UVCDxepIb+yGDHESm9rwb/1Na0kslNPh9/18ngZ40sHBAerxcxFVGav1JBqpModE usf64H3xiBzIyxHbCzPhiSKZjuP2WXNV5k153rCG8bbreTfUXxpO6nIBHT2ie6sA xo7tN66AmN2fouxMIFYERIbL7S5S8fBkO1tsaF+VSveBx2heTQ84k+P4TCVD7PQB IU+TPXg+Vrz15tiVSoSI+Ep+rV2pzKOFQXl0adOUisV8tMMFJD3YSwbUoTreM8tq 7CAyWhCxjnbgiedG1qF/J55WYdNyc9PorK7Kjx6wTRHLVQhF1W80OT8X5gvFbUoe PnzNTp2zi/4hKZfl/8G2tN0VZqhEynCT+iaDO0hG7VVz8DJfDz+9699KpoSVbiad pHiRORulU3/gYKLAYYpOo1fx6AP1utcmDfwEiJEROfZqkMI+CW5HTXGZavr3eImq JhZFsrtSvitXGwcGW6bYDoR56NaV9+A2PUlVt9PrlAonus06tuj2/o47jrdxmX1K aEp3uWVh0ZFSjc2YazmaN/zJyECP7b5Ig2wvhjDh39QqlYPocSZnNnZkWlUi6x3r OQ7ffkqepcFD+Zafm8vU95xs8ehFY+Jivdbbj4P3kff1LBv8NQ6KDKA4eiliDrnO Ml/B1TwipND2PVg8qEq2n64cYJpeGD/Hrcr8PlAvH+v8Xc9VJaerB8yeg9FqyJS7 7dAAkJsgWXBx1bfK6BUkJ/CefNjOYjtizwhVa1uQFOZjpg057WEo0m+dw7nCEG5M 3VexMu/Kx96dI5+hqs6SWSf6rC+Jj74J5cyvtoZZ2XdHl8GzrKt4mHf+XFpqTefG TjwNkYPnofKXfXe/R14wifThs2thVmM6tY5TJBtGdqOVVhJ2wbsbByQ2ivVYBCW3 hAA= =1dpX -----END PGP MESSAGE-----
- 10y ago

Groxx 10y ago

Q: group chats? Seems like it could be done by encrypting (and sending) the message to all recipients, so it's not particularly efficient, but it's a valuable UI thing.

mmerickel 10y ago
If you install the client there is an "i" info button in the upper right of chat that allows you to add participants.

derefr 10y ago

Huh, the channels support is just in time to replace App.net (or maybe "to do App.net right", since it didn't really get off the ground.)

mekaj 10y ago

Thank you and the Keybase team for this. Unlike other services, I think KB has solved the online identity authentication issue. There's one hurdle I need to work through to get going on chat. Thus far I've avoided uploading my private GPG key to my Keybase profile, or even copying it to other devices (call me paranoid). Unfortunately this apparently means I can't authorize any other devices (see error message: http://imgur.com/a/UOftN http://imgur.com/a/UOftN). I assumed device keys were meant to solve this problem, but maybe not. Is there a supported way to make a subkey (GPG or otherwise) of my primary private GPG keypair, so other devices can securely authenticate against my KB profile? EDIT: I haven't yet started using device keys. Maybe they would work?

NickBusey 10y ago
This is answered in the FAQ at the bottom of the post. You'll see this policy in action when you install Keybase on a 2nd computer. It'll make you either (a) type something on your first computer, or (b) enter a paper key. This isn't just two-factor auth with server trust. The old key is signing a statement about the new key, and the new key is countersigning.
philsnow 10y ago
It could be formatted better: it's telling you you have three different options, one of which is, Install Keybase on a different machine that has your PGP key I was in the same boat as you, I didn't want to import my private key onto this mac laptop because I don't know how the "Keychain.app" works and don't trust apple to not do something super helpful like store my GPG private key forever and always. I did the login flow on the machine I do trust, and was then able to use that machine to authorize the mac laptop, without moving any GPG keys anywhere.
- mekaj 10y ago
  I interpreted that option as Keybase needing a local copy of the PGP key. Thanks for helping me understand that's not the case. I've set up Keybase on my trusted machine with my GPG keypair, and now have a device key on that machine. When I go to Devices -> Add new... -> New Computer in the GUI I'm told to "Type in text code" (along with the note "In the Keybase app on your computer, go to Devices > Add a new device"). I find this confusing because I'm already there. I tried using the only paper key I have, the one corresponding to my first device key, but there's no response when I click Continue. This is the Linux client, by the way. I'm guessing this is a bug, but I'm not sure. Can you confirm this is the same process you went through to generate your second device key? When I try to log in on the secondary computer, which doesn't have the GPG keypair or a device key, I'm brought to the same error shown in the screenshot.

sisk 10y ago

This is awesome! Thanks! Wondering if you can clarify a bit—what parameters cause a chat to/not to show up in the GUI? Different topics? Different channel names? I have a use for this immediately and am excited to give it a shot!

malgorithms 10y ago
For program-to-program talking, use the "dev" channel, in a topic of your choice. (By default --topic-type=chat and changing it to dev keeps it out of the GUI) For example: keybase chat send friend1,friend2\ --topic-type=dev\ --topic-name=KEYBASE-SYSOPS\ "server-restart [reason:hot and bothered]" I'll never see this in the GUI but you and your friend1 and friend2, can access the messages through the chat API. The topic-name can be whatever you want, and it allows you to structure messages into channels. ---- If you're using the JSON api - which makes more sense if you're programming it - take a look at `keybase chat help api` to see some examples of how to structure the JSON going in. Anywhere you see a `channel` object, you can add `topic_type` and `topic_name` to them. Both should be strings.
- Natanael_L 10y ago
  Why is non-PFS the default? You wrote that somewhere in the documentation. You said something about violating expectations when you sync PFS'd chat contents, but I don't see why that's relevant unless people were promised otherwise. There's nothing about the encryption algorithm itself that dictates how data going over it should be handled at the endpoints. Just let users have a regular mode and an off-the-record mode where nothing is kept. Both PFS protected.

brightball 10y ago

Just installed and it's still asking me for an invite code on the Fedora RPM.

oconnor663 10y ago
Could you file an issue over at https://github.com/keybase/client/issues https://github.com/keybase/client/issues and tag @oconnor663 in it please? And maybe include the output of `keybase --version`?
- brightball 10y ago
  Done.
- huevosabio 10y ago
  I'm also getting an invite request for macOS
malgorithms 10y ago
and for now if anyone hits this, just use the invite code `zcash`. We've left that bypass code working since our recent blog post.
mutecipher 10y ago
I had the same issue, but signing up on the website seemed to work fine and then I was able to log in without issue.

kilrathi 10y ago

I was wondering about that very thing when playing with it; encrypted app-to-app comm via the chat. Maybe something similar for the file system with a pair of pipe files.

wazanator 10y ago

Any plans for Steam support?

bootload 10y ago

"it's possible with Keybase chat to have a program posting encrypted messages for another person or program, without cluttering up the visual chat interface." Nice. I'll be looking at what source of tools that use this style of communication on github.

CMay 10y ago

One thing I've noticed so far is that with the Keybase desktop client on Windows 10, the "Reddit Form" button for submitting a proof didn't work for me. It just fails silently and doesn't open a browser window or whatever it's supposed to do. Additionally I am curious why on Reddit people have to post a wall of text, while on Twitter you only have to post a small tweet? Is there some reason people can't just paste the tweet version onto Reddit too?

thek3nger 10y ago
Same problem here.

kelnage 10y ago

I'm entirely unconvinced by your argument regarding backing up a perfect forward secrecy chat. PFS is about preventing any listener of the messages in-transit from ever effectively decrypting those messages - it says nothing about security guarantees once the message is received. It'd be like arguing that by enabling PFS also creates a social contract that the receiver guarantees that their device isn't compromised. Or that webservers that use PFS in TLS don't log most/all of the details for the requests they receive. I don't believe either of these to be true. You seem to have extrapolated some social properties from a purely technical property and assumed everyone must think about it in the same way as you. But in doing so, you've made your protocol weaker against realistic attacks. Oh, and the likelihood of an attacker stealing a device with WhatsApp installed and only being able to extract the identity keys and not the cached messages seems absurdly improbable. Personally, I wish you'd either tried to work with OWS/WhatsApp/whoever to integrate in what makes keybase.io great (providing identity verification - something that all these could use) and not gone about adding to the already crowded area of chat providers.

oconnor663 10y ago
To be clear, all of Keybase's client-server traffic goes over TLS and benefits from TLS's forward secrecy on the wire.
- kelnage 10y ago
  I can believe that is the case, but that just moves the attack vector to within Keybase's network, it doesn't mitigate it completely.
- Natanael_L 10y ago
  Please see this comment: https://news.ycombinator.com/item?id=13605873 https://news.ycombinator.com/item?id=13605873 Nothing stops you from going full PFS. In fact, you could even flip it around and let a shared notepad connected to the chat represent what you want to remember permanently, while the chat could remain ephemeral. This makes for more accurate expectations and less risk of user error.

zapu 10y ago

Oh! And I was wondering whether someone has invited me and I haven't noticed, or if you don't need invitations anymore. Thanks

0xADADA 10y ago

Are ya'll going to post a SHA checksum for the downloadable dmg alongside the download?

cjbprime 10y ago
Probably not. It's a TLS connection -- if someone can lie about the contents of the DMG, they can lie about the hash too. How would it help?