5 ms·

Warning to all OS X users: The Keybase Chat desktop app does a number of shady things that ultimately led me to delete it from my system. I am writing this pu

by cgijoe 10y ago

Warning to all OS X users: The Keybase Chat desktop app does a number of shady things that ultimately led me to delete it from my system. I am writing this purely as a public service announcement, to those who worry about installing unknown apps on their Macs. The Keybase Chat app: (1) Requires administrator privileges to launch on first run, to install a "Helper Tool". The app does not explain what this tool does, where it lives, nor does the Keybase website. (2) Installs a login (startup) item without asking permission, so Keybase will auto-launch on every boot. (3) Installs a Finder Favorite in your Finder sidebar, without asking permission. (4) Installs /usr/local/bin/keybase without asking permission. (5) Installs /Library/PrivilegedHelperTools/keybase.Helper without asking permission. (6) Installs /Library/LaunchDaemons/keybase.Helper.plist without asking permission. (7) Installs ~/Library/LaunchAgents/keybase.* (3 files) without asking permission. (8) Runs permanently in your menu bar, even if you quit the main app. These things may all have good reasons and be benign, but they are too shady for me, so I deleted the app and all the files listed above. Apologies to the devs.

hack4jesus 10y ago
i happen to know that the main developer is russian
rw 10y ago
How did you find these changes?
- arm 10y ago
  Not the parent, but it’s pretty easy to find all files on disk with a particular name with something like Find Any File¹. ―――――― ¹ — http://apps.tempel.org/FindAnyFile/ http://apps.tempel.org/FindAnyFile/
- cgijoe 10y ago
  I used the Unix "locate" command-line tool. I just searched for "keybase". Note that you have to build up a locate DB first by calling "sudo /usr/libexec/locate.updatedb". Type "man locate" in Terminal to learn more.
  - HereticLocke 10y ago
    "locate" is not an Apple command-line tool. It is a Unix command.
    - terrywang 10y ago
      For those who are curious: To be accurate, locate is a command provided by mlocate package (shipped by most modern distributions) which supersedes GNU slocate. mlocate is a locate/updatedb implementation. The 'm' stands for "merging": updatedb reuses the existing database to avoid rereading most of the file system, which makes updatedb faster and does not trash the system caches as much. The locate(1) utility is intended to be completely compatible to slocate. It also attempts to be compatible to GNU locate, when it does not conflict with slocate compatibility. Reference: https://fedorahosted.org/mlocate/ https://fedorahosted.org/mlocate/
  - rrdharan 10y ago
    Note you can also use 'mdfind' for this (assuming you haven't disabled Spotlight), no need to build the updatedb. I actually have locate aliased to mdfind in my bashrc.
- lelf 10y ago
  For instance, fs_usage(1)
mark242 10y ago
To play devil's advocate, steps 1, 2, 4, 5, and 6 are all fairly standard behavior for a Mac app that is installed "for all users on this system". https://developer.apple.com/library/content/samplecode/SMJobBless/Listings/ReadMe_txt.html https://developer.apple.com/library/content/samplecode/SMJob... Step 2 and 7 are fairly standard behavior for an application that is meant to be running at all times, eg a persistent chat app. Even something like GPG installs files into /Library/LaunchAgents. The location of the directories in question shouldn't set off a warning flag about whether an app is "shady" or not.
- cgijoe 10y ago
  I accept your devil's advocacy, but I would argue that the app should have simply asked permission before doing these things, especially installing itself as a startup item and adding a Finder favorite. Also, if the app is going to install things as an administrator, it should tell the user exactly what it plans to do. Just my $0.02. I know that Keybase the company is not shady, but their chat app sure feels off to me.
  - rrdharan 10y ago
    Note that the app does ask for permission before installing the helper, i.e. via the standard macOS elevation prompt; agreed though that it doesn't actually explain what the helper is for or what it will do.
Sidnicious 10y ago
The whole client is open source: https://github.com/keybase/client https://github.com/keybase/client As far as I know, it asks for root because the Keybase filesystem runs on Fuse, and the menu bar app can be quit from its menu. It's hard to balance making a simple, self-contained app with providing easy installation, a custom filesystem, automatic updates, and a command line tool… if you have ideas on how to improve things, I think they'd be open to issues/PRs. (I used to work on Keybase. I personally trust the devs, but, really, you can build from source if you want.)
wyager 10y ago
Ugh. Even if these things are fairly common practice for mac apps, there's no reason that a chat app needs to install a bunch of crap to launch on root. By default, unless absolutely necessary, your app should install with only user-level permissions and should not attempt to insert itself into the boot process. Just let me click on the app when I want to open it. I don't need toolbars, I don't need a launch daemon, I don't need a global install. If you think those features are really great for some reason, let users opt into them later on.
- agravier 10y ago
  It's not a chat app. They do those to install the keybase filesystem. The chat is a secondary feature.
INTPenis 10y ago
I'm not qualified or interested enough to investigate this but I can tell you that on Windows Trend Micro have blocked keybase as potential malware. It's reported on github and keybase have requested an exception but reading your post one starts to wonder why Trend Micro would get that idea.
- jameskegel 10y ago
  I suspect this is because of the kb.io filesystem
- cpach 10y ago
  Just a heads up that you might want to be careful with trusting Trend Micro too much... https://bugs.chromium.org/p/project-zero/issues/detail?id=773 https://bugs.chromium.org/p/project-zero/issues/detail?id=77...
  - INTPenis 10y ago
    I'm glad you showed me that but unfortunately I'm required to run it by my organisation. And even if I do disable it we have VPN software that requires some sort of AV before you're granted access.
rpdillon 10y ago
The feeling that the app is shady (because of permission overreach) may stem from the notion that Keybase is a chat app. It is, perhaps in the same sense that a browser running Slack is a chat app. It also includes crytographic key management and message handling via both GUI and command line (the core product), as well as a FUSE-based file system interface that allows transparent encryption/decryption with other users (Keybase FS). Viewed in that light, the installation footprint might be considered more reasonable.
hgezim 10y ago
Had an interesting manifestation of this overreach. I'm using a gulp task to watch for file changes. `gulp-notify` gives me this error. I cleaned up keybase from my system but still getting this: ``` Message: 2017-02-09 11:37:56.154 terminal-notifier[2293:8114763] kCFURLVolumeIsAutomountedKey missing for file:///keybase/: Error Domain=NSCocoaErrorDomain Code=257 "The file “keybase” couldn’t be opened because you don’t have permission to view it." UserInfo={NSURL=file:///keybase/, NSFilePath=/keybase, NSUnderlyingError=0x7ffca345de60 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}} ```
hobarrera 10y ago
> Installs /usr/local/bin/keybase without asking permission I'd guess that any installer would be expected to do this, this particular item doesn't sound "shady".

by cgijoe 10y ago

hack4jesus 10y ago

i happen to know that the main developer is russian

rw 10y ago

How did you find these changes?

arm 10y ago
Not the parent, but it’s pretty easy to find all files on disk with a particular name with something like Find Any File¹. ―――――― ¹ — http://apps.tempel.org/FindAnyFile/ http://apps.tempel.org/FindAnyFile/
cgijoe 10y ago
I used the Unix "locate" command-line tool. I just searched for "keybase". Note that you have to build up a locate DB first by calling "sudo /usr/libexec/locate.updatedb". Type "man locate" in Terminal to learn more.
- HereticLocke 10y ago
  "locate" is not an Apple command-line tool. It is a Unix command.
  - terrywang 10y ago
    For those who are curious: To be accurate, locate is a command provided by mlocate package (shipped by most modern distributions) which supersedes GNU slocate. mlocate is a locate/updatedb implementation. The 'm' stands for "merging": updatedb reuses the existing database to avoid rereading most of the file system, which makes updatedb faster and does not trash the system caches as much. The locate(1) utility is intended to be completely compatible to slocate. It also attempts to be compatible to GNU locate, when it does not conflict with slocate compatibility. Reference: https://fedorahosted.org/mlocate/ https://fedorahosted.org/mlocate/
- rrdharan 10y ago
  Note you can also use 'mdfind' for this (assuming you haven't disabled Spotlight), no need to build the updatedb. I actually have locate aliased to mdfind in my bashrc.
lelf 10y ago
For instance, fs_usage(1)

mark242 10y ago

To play devil's advocate, steps 1, 2, 4, 5, and 6 are all fairly standard behavior for a Mac app that is installed "for all users on this system". https://developer.apple.com/library/content/samplecode/SMJobBless/Listings/ReadMe_txt.html https://developer.apple.com/library/content/samplecode/SMJob... Step 2 and 7 are fairly standard behavior for an application that is meant to be running at all times, eg a persistent chat app. Even something like GPG installs files into /Library/LaunchAgents. The location of the directories in question shouldn't set off a warning flag about whether an app is "shady" or not.

cgijoe 10y ago
I accept your devil's advocacy, but I would argue that the app should have simply asked permission before doing these things, especially installing itself as a startup item and adding a Finder favorite. Also, if the app is going to install things as an administrator, it should tell the user exactly what it plans to do. Just my $0.02. I know that Keybase the company is not shady, but their chat app sure feels off to me.
- rrdharan 10y ago
  Note that the app does ask for permission before installing the helper, i.e. via the standard macOS elevation prompt; agreed though that it doesn't actually explain what the helper is for or what it will do.

Sidnicious 10y ago

The whole client is open source: https://github.com/keybase/client https://github.com/keybase/client As far as I know, it asks for root because the Keybase filesystem runs on Fuse, and the menu bar app can be quit from its menu. It's hard to balance making a simple, self-contained app with providing easy installation, a custom filesystem, automatic updates, and a command line tool… if you have ideas on how to improve things, I think they'd be open to issues/PRs. (I used to work on Keybase. I personally trust the devs, but, really, you can build from source if you want.)

wyager 10y ago

Ugh. Even if these things are fairly common practice for mac apps, there's no reason that a chat app needs to install a bunch of crap to launch on root. By default, unless absolutely necessary, your app should install with only user-level permissions and should not attempt to insert itself into the boot process. Just let me click on the app when I want to open it. I don't need toolbars, I don't need a launch daemon, I don't need a global install. If you think those features are really great for some reason, let users opt into them later on.

agravier 10y ago
It's not a chat app. They do those to install the keybase filesystem. The chat is a secondary feature.

INTPenis 10y ago

I'm not qualified or interested enough to investigate this but I can tell you that on Windows Trend Micro have blocked keybase as potential malware. It's reported on github and keybase have requested an exception but reading your post one starts to wonder why Trend Micro would get that idea.

jameskegel 10y ago
I suspect this is because of the kb.io filesystem
cpach 10y ago
Just a heads up that you might want to be careful with trusting Trend Micro too much... https://bugs.chromium.org/p/project-zero/issues/detail?id=773 https://bugs.chromium.org/p/project-zero/issues/detail?id=77...
- INTPenis 10y ago
  I'm glad you showed me that but unfortunately I'm required to run it by my organisation. And even if I do disable it we have VPN software that requires some sort of AV before you're granted access.

rpdillon 10y ago

The feeling that the app is shady (because of permission overreach) may stem from the notion that Keybase is a chat app. It is, perhaps in the same sense that a browser running Slack is a chat app. It also includes crytographic key management and message handling via both GUI and command line (the core product), as well as a FUSE-based file system interface that allows transparent encryption/decryption with other users (Keybase FS). Viewed in that light, the installation footprint might be considered more reasonable.

hgezim 10y ago

Had an interesting manifestation of this overreach. I'm using a gulp task to watch for file changes. `gulp-notify` gives me this error. I cleaned up keybase from my system but still getting this: ``` Message: 2017-02-09 11:37:56.154 terminal-notifier[2293:8114763] kCFURLVolumeIsAutomountedKey missing for file:///keybase/: Error Domain=NSCocoaErrorDomain Code=257 "The file “keybase” couldn’t be opened because you don’t have permission to view it." UserInfo={NSURL=file:///keybase/, NSFilePath=/keybase, NSUnderlyingError=0x7ffca345de60 {Error Domain=NSPOSIXErrorDomain Code=1 "Operation not permitted"}} ```

hobarrera 10y ago

> Installs /usr/local/bin/keybase without asking permission I'd guess that any installer would be expected to do this, this particular item doesn't sound "shady".