43 ms·

Keybase launches encrypted Git

1427 points by aston 9y ago

gwenzek 9y ago
I don't really understand how it works. Are the git objects encrypted before being pushed? In that case how are they handled by the server? Does it accept them even though they make no sense? What Github is going to show?
- mrsteveman1 9y ago
  Keybase is just another Git remote you can push to, one that transparently encrypts whatever is pushed to that remote. The Git repo itself is completely normal in every other respect, so if you push to Github, everyone can still see the entire repo. This is a good design as it lets people move repos easily and avoid too much lock-in, but it may (will...) come back to bite people soon, who push things to Github thinking they were "encrypted by Keybase", which is not what's going on.
malgorithms 9y ago
Keybase team member here. Interesting fact: git doesn't check the validity of sha-1 hashes in your commit history. Meaning if someone compromises your hosted origin, they can quietly compromise your history. So even the fears about data leaks aside, this is a big win for safety. From an entrepreneurial perspective, this is my favorite thing we've done at Keybase. It pushes all the buttons: (1) it's relatively simple, (2) it's filling a void, (3) it's powered by all our existing tech, and (4) it doesn't complicate our product. What I mean by point 4 is that it adds very little extra UX and doesn't change any of the rest of the app. If you don't use git, cool. If you do, it's there for you. What void does this fill? Previously, I managed some solo repositories of private data in a closet in my apartment. Who does that? It required a mess: uptime of a computer, a good link, and dynamic dns. And even then, I never could break over the hurdle of setting up team repositories with safe credential management...like for any kind of collaboration. With this simple screen, you can grab 5 friends, make a repo in a minute, and all start working on it. With much better data safety than most people can achieve on their own.
- Foxboron 9y ago
  While talking about git and security: Signing tags are not as affective as you'd think. refs are never actually signed, it's the objects they are pointing at that are signed. This opens up to interesting attacks where you can move refs around to previous vulnerable versions. Git also never checks if the metadata the tag points at is correct! Interesting paper: https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_torres-arias.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
  - im_down_w_otp 9y ago
    Yeah, we implemented this paper's proposal (their version has some bugs, gaps, and infinite loop issues) where I work to be able to have higher assurance on the validity of our source repositories. First version in shell with a fairly robust test suite, and the next version in Rust. Originally started to do it in Rust, but libgit2 was sufficiently obtuse that we opted for getting to a complete, working thing first.
- ianleeclark 9y ago
  For your first point, can't you verify the signature for the commit? In order to to compromise the origin, they must also compromise the secret key of whoever is signing commits. I say that in full realization that 99% of people probably don't even know that you can sign commits, but the first point doesn't seem valid, as you can ensure integrity of commit history.
- gaxun 9y ago
  > hurdle of setting up team repositories with safe credential management...like for any kind of collaboration Identity continues to be the key selling point of keybase. I'm excited by this. I can keep clones of my private repositories here. Things like dotfiles and configurations. That sounds like a good start. And I can also easily share code to people who need to see it.
- mikeash 9y ago
  This looks sweet. I bounce between using Bitbucket or Dropbox for private repos depending on my needs. Bitbucket has lots of features but is a little annoying to set up a new project. Dropbox is really easy but doesn't always work well (e.g. git push ends up being effectively async). Your version of it looks to be just as easy as Dropbox, maybe even easier, but without any of the downsides. And it's encrypted!
zeroxfe 9y ago
I'm really happy about this. I have private repos for personal information (e.g., tax spreadsheets going back a decade) that I keep synchronized across machines, and have to jump through hoops to get an encrypted authoritative remote source. Right now I do that with an encrypted partition on a private VM. And, it really sucks that GitHub does not encrypt data at rest: --- SNIP from https://help.github.com/articles/github-security https://help.github.com/articles/github-security --- We do not encrypt repositories on disk because it would not be any more secure: the website and git back-end would need to decrypt the repositories on demand, slowing down response times. Any user with shell access to the file system would have access to the decryption routine, thus negating any security it provides. Therefore, we focus on making our machines and network as secure as possible. --- SNIP --- Encrypted disks are now the norm across various cloud providers, as is HTTPS. The crypto overheads are really low, and their benefits significantly outweigh the risks of leaving clear-text data on disks. Also, defense-in-depth is always worth pursuing. The claim "it would not be any more secure", is so far from true, it's almost insulting to their target audience. Keep killin' it, Keybase! Great job!
- yorick 9y ago
  Out of curiosity, what are the benefits you're talking about?
- eslaught 9y ago
  It certainly depends on the threat model, but in this case I have to agree with Github---adding at-rest encryption would be unlikely to make their product significantly more secure, and it would certainly be nowhere as secure as Keybase. With Keybase, the data is encrypted on the client, and the keys stay on the client. Assuming the crypto is done right, there is fundamentally no way for Keybase to read the data, and therefore no way for an attacker to get the data by way of compromising Keybase. The only way for an attacker to get the data is by compromising the client machine, which is a very different threat model. With the model you're proposing for Github, the data would be encrypted for transfer (via HTTPS or SSH), but then it would be immediately decrypted again on the server. Even if it is encrypted again before it's put onto the disk, fundamentally the key lives on the server (and has to in order to provide Github's feature set) and so an attacker who had compromised the machine would simply grab the key before going after the files on disk. The actual additional security you get is really not that significant. Personally, I appreciate Github's stance on this. There have been a number of "secure" products (see e.g. Lavabit) that have really been snakeoil because they used the approach above. I'll take honesty over false promises any day---at least with the former, I understand my risk and can take steps to mitigate appropriately.
j7ake 9y ago
Hi security newbie here, I have private bitbucket repo for storing my pass data. One problem is that pass often leaks some metadata like headers of directories. From security standpoint does this mean it is more private to host the git repo on keybase versus bitbucket ?
- jredmond 9y ago
  That depends - is that data encrypted on your system? Since git is decentralized, there's a chance that any plain-text copy (such as a clone on your system) could be compromised. Keybase even addresses this in the FAQ, to an extent: > What if my computer is compromised? > Your work is only as safe as your endpoints, so we can't help you there. This applies regardless of host or protocol, BTW, and it isn't even specific to computing. (It doesn't matter how many locks you have on your front door if you leave the back door propped open.)
  - j7ake 9y ago
    Hi pass uses gpg encryption on the text files my only concern are the file names which can leak meta info, for example just searching GitHub https://github.com/zurchpet/pass https://github.com/zurchpet/pass shows this person has passwords in a public repository but encrypted. Nevertheless I can see that the file names are credit card info and other sensitive info. It's like having a safe with a label "important stuff inside" ! Does keybase solve this problem ?
    - tanderson92 9y ago
      Yes, the contents of the git repository holding your pass files are encrypted, meaning that the file names are not visible to anyone without the private key (you). You may also want to look at https://github.com/roddhjav/pass-tomb https://github.com/roddhjav/pass-tomb
      - j7ake 9y ago
        Thanks for that I'll consider it.
tln 9y ago
This is pretty cool. I've used git-crypt before to encrypt parts of a repo, but this approach seems much easier to manage. https://github.com/AGWA/git-crypt https://github.com/AGWA/git-crypt
elahd 9y ago
This is excellent. I've been looking for practical uses for my Keybase account -- it's been sitting around, verified but idle for years. The chat app is nice, but none of my friends or co-workers use the service (or understand crypto, for that matter).
NikolaeVarius 9y ago
My first initial gut thought is, could this be as a good ol cross platform method of password management? I've never been able to properly manage keepass due to syncing between different platforms being a pain.
- tehno 9y ago
  Maybe combine Keybase git with gopass, that one stores data in a git repo: https://www.justwatch.com/gopass/#features https://www.justwatch.com/gopass/#features
  - NikolaeVarius 9y ago
    That sounds promising. I can't be the only one with this problem. (aka secure cross platform synchronized password management without requiring personal/managing cloud infrastructure.
- stevenleeg 9y ago
  https://www.passwordstore.org/ https://www.passwordstore.org/ This might be exactly what you're looking for :)
- raesene9 9y ago
  https://github.com/kbsecret/kbsecret https://github.com/kbsecret/kbsecret is Secrets management back by Keybase :)
- woodruffw 9y ago
  This is something that I've been working on for about a year using Keybase[1]. [1]: https://github.com/kbsecret/kbsecret https://github.com/kbsecret/kbsecret
- eridius 9y ago
  I've had nothing but good experiences using 1Password.
  - NikolaeVarius 9y ago
ericfrederich 9y ago
Awesome... any plans to support LFS? I know with LFS you can write custom backend handlers.
- markdog12 9y ago
  First thing I thought of too. Would be an awesome feature. Edit: Just tried and no dice: 'Remote "origin" does not support the LFS locking API.'
- sridvijay 9y ago
  Was just thinking that as well, the hard part about changing GitHub hosts like bitbucket/github is the feature parity between them. This is really enticing though.
philip1209 9y ago
Some hypothetical questions: - How could CI/CD be set up? (Is read-only access possible to the repo? Would Keybase work on a Jenkins box? Could a deploy server verify signatures before deploying?) - Could one set up mirroring to GitHub? How would this work? (I could see the signing without encryption as a value-add) - What happens in the event of a force push? Could certain users destroy history? - Could protected branches eventually be added, eg only certain users can push to master?
- strib 9y ago
  > - How could CI/CD be set up? (Is read-only access possible to the repo? Would Keybase work on a Jenkins box? Could a deploy server verify signatures before deploying? You could have a deploy/CI user as a "reader" in your team. But we don't yet support hooks or anything (as that implies running arbitrary code on endhosts without their knowledge), so it would have to pull the repo. > Could one set up mirroring to GitHub? How would this work? (I could see the signing without encryption as a value-add) You can of course continue to use Github as a regular remote, but you'd lose all the encryption and signing unfortunately. > - What happens in the event of a force push? Could certain users destroy history? We do currently allow force pushes. Being able to turn that off on a repo-by-repo basis is something we'll consider in the future, definitely. > Could protected branches eventually be added, eg only certain users can push to master? Yes, but again, as with any "server"-side feature, this is complicated by the fact that it has to run on the client itself, and thus isn't really strictly enforceable against modified clients. As we get more experience with people using this, we will definitely be thinking about how to make it better by adding power features like these. Thanks for the feedback!
ericfrederich 9y ago
This removes the ability for collaborating, browsing online, basically any feature of GitLab/GitHub/BitBucket. ... I think I'm in favor of this. I think of the things that those services provide on top of Git should actually be ported or mapped to Git itself. Branches, pull requests, comments, etc... should all be Git objects of some sort.
- quadrangle 9y ago
  Branches are Git objects. Incidentally, here's a distributed VCS that includes bug tracking: https://fossil-scm.org https://fossil-scm.org
  - falsedan 9y ago
    > Branches are Git objects That's not how I understand refs, they don't even live in the .git/objects hierarchy.
    - ericfrederich 9y ago
      You're correct, they're just files. To create a new branch off of master you can just... cp .git/refs/heads/master .git/refs/heads/WTFFF ... no SHA-1 involved at all, no parent, history, etc.
      - swsieber 9y ago
        However what they point to are git objects. And being pointed to prevent them from being garbage collected (pruned).
    - quadrangle 9y ago
      I guess I don't understand what GitHub/GitLab does that makes branches different from Git itself (which seemed to be the claim I was replying to).
      - falsedan 9y ago
chishaku 9y ago
In case you're wondering... > ~ Anticipated q's ~ > What if we're living in a simulation? > Keybase offers no guarantees against sophisticated side-channel attacks by higher-level entities.
- rotrux 9y ago
  > ~ Anticipated A's ~ > YES. IT'S LIKE THE MATRIX BUT INSTEAD OF ROBOTS IT'Z LIZARD PEOPLE. > THIS ISN'T A QUESTION BUT GOOD POINT. WE R BEGINNING THE MOVE UNDERGROUND.
- seanlane 9y ago
  It appears that this may no longer be an open question: http://www.pbs.org/wgbh/nova/next/physics/physicists-confirm-that-were-not-living-in-a-computer-simulation/ http://www.pbs.org/wgbh/nova/next/physics/physicists-confirm... There was a Hacker News post about this a few days ago, likely from a different source, but I can't find it.
  - rorosaurus 9y ago
    Doesn't this simply suggest that the reality that is simulating our universe would have to be fundamentally different than our own?
  - jsjohnst 9y ago
    I remember reading something a decade or so ago which said that to simulate the entire known universe, even using selective windowing, would require more energy than the entire universe has. Wish I could remember the source.
  - qudat 9y ago
    This only applies to classical computers not quantum, some combination of both, or by some means of computation we haven't discovered yet.
  - rvern 9y ago
    No: https://www.scottaaronson.com/blog/?p=3482 https://www.scottaaronson.com/blog/?p=3482.
falsedan 9y ago
Nice to see people work on git remote helpers, a shame that there's already a fine remote helper that is not tied to a specific hosting provider & uses GPG[0] already. 0: https://spwhitton.name/tech/code/git-remote-gcrypt/ https://spwhitton.name/tech/code/git-remote-gcrypt/
- zeveb 9y ago
  I came here precisely to see how this compares to git-remote-gcrypt (which I use to protect my password-safe filenames). Anyone from keybase prepared to comment?
  - ptspts 9y ago
    I'm not a Keybase developer, but I'm a user of Keybase Git, git-remote-gcrypt and git-gpg, and I've just written a comparison of the 3. Here you are: http://ptspts.blogspot.com/2017/10/comparison-of-encrypted-git-remote.html http://ptspts.blogspot.com/2017/10/comparison-of-encrypted-g... If I missed some of the aspects, please let me know.
- nimnio 9y ago
  Could you explain what's a shame? I'm having trouble guessing your point.
OrangeTux 9y ago
Keybase has quite a few interesting and unique features. But I'm cautious, because it's not clear to me how they are going to monetize it.
notheguyouthink 9y ago
As an aside, does key base offer tools to encrypt data from code, lets say from Python/Go/Rust/etc, that is moron proof? I say tools, because while a library would be cool, I'd understand if it was a binary/application to provide the functionality/user-experience that key base is aiming for. I know this likely doesn't sound like something key base should be aiming for, but to me, programmers need encryption just as much as users. I'd like to write my libraries/programs with encryption, but I also want to be able to trust it and not fear some inherent vulnerability I'm adding. To me, Keybase is aiming to solve/reduce these complexities for users, and I'm hoping they also aim to solve it for developers to. Thanks for all the hard work folks @ Keybase, it's definitely appreciated!
- danenania 9y ago
  Go has a good openpgp package: https://godoc.org/golang.org/x/crypto/openpgp https://godoc.org/golang.org/x/crypto/openpgp I wouldn't say it's foolproof though. I agree that simpler, higher-level libraries are needed across the board.
- edraferi 9y ago
  Keybase has a public API [0]. There's a community Python library, but it appears to be unmaintained [1]. [0] https://keybase.io/docs/api/1.0/intro https://keybase.io/docs/api/1.0/intro [1] https://github.com/adamldoyle/python-keybase-client https://github.com/adamldoyle/python-keybase-client
- hamandcheese 9y ago
  Check out libsodium/nacl. Go has an implementation of the box api[0] which is pretty foolproof. There are bindings and/or implementations in many languages. [0]: https://godoc.org/golang.org/x/crypto/nacl https://godoc.org/golang.org/x/crypto/nacl
- ofek 9y ago
  This is a perfect use case for https://github.com/ofek/privy https://github.com/ofek/privy
phren0logy 9y ago
I really like keybase, and I wish they could issue certs for me to sign PDFs. I would pay for that.
hdhzy 9y ago
Sounds intriguing but I'm missing the deep technical info on how it works. > All data you push is signed by your device's private key, which never leaves your device. For the reference git already supports signed pushes (git push --signed): https://github.com/git/git/commit/a85b377d0419a9dfaca8af2320cc33b051cbed04 https://github.com/git/git/commit/a85b377d0419a9dfaca8af2320...
- welder 9y ago
  Signing a commit does not encrypt that commit's contents, just adds a signature to prove you wrote that commit. From the Keybase FAQ: > So is this signing my commits? > No, this is happening at a lower level, (1) to allow encryption, and (2) to ensure no unsigned or unencrypted data makes it in. Intuitively you can think of it as you and your teammates using a cryptographic secure storage layer for your git origin that doesn't really understand git. > Your commits themselves are untouched from git's perspective, so if you mirror your repository elsewhere, it'll be a regular checkout.
  - hdhzy 9y ago
    I did not mention signing commits but signing push requests and that was a reference to: > All data you push is signed by your device's private key, which never leaves your device.
Walkman 9y ago
I have a private repo on GitHub which contains my dotfiles with SSH private keys, tokens, secrets and all kinds of secret stuff. I was uncomfortable storing it there, but my laziness/lack of time kept it there. Finally I will be able to encrypt the entire repo, yay!!
- philsnow 9y ago
  if you're uncomfortable storing them there, you're going to rotate all the secrets after you move the repo to keybase, right?
  - Walkman 9y ago
    Yes, I will. That's a long overdue also :D
- hasenj 9y ago
  did you delete the unencrypted repo from github? actually even if you did, a version of it might still be lurking in some corner. Maybe time to create a new set of private keys?
adiosdfisndf 9y ago
Tried to create an account and no matter what I tried to name my devices all I got was "keybase has reserved this name." Welp.
- cjbprime 9y ago
  Ah, it's not the device names that are reserved, it's the username itself.
paule89 9y ago
just to clarify: 1. Do you need a private git repository? 2. Is everything really encrypted? 3. If everything is encrypted how can i access it through Git Desktop?
- pkd 9y ago
  From what I understood (I haven't actually used the product), the repository is in the decrypted state on your local machine and is fully encrypted while being stored on the remote.
- netcraft 9y ago
  re: #1 I just tried it - they are giving you an encrypted git remote. So you create a new repo with them, then you can clone it somewhere (or add it as a remote) and push to it.
- nickik 9y ago
  Git repository are private for you or for a team that you select. Yes, everything is encrypted on your machine locally.
- strib 9y ago
  You can have team-based or private repos hosted by Keybase. Everything is encrypted and signed before it leaves your computer, and decrypted and verified when your computer downloads it. But your local checkout of that git repo is unencrypted. It's just a normal repo. So Github Desktop has full access to it, like it does for all files in your local filesystem.
therealmarv 9y ago
If you go crypto don't use git. It's not designed for cryptography in mind and the Keybase approach looks nice IF I can control every chain or can keep using github (or any other git server) with it. But for the storing part alone I would not trust Keybase. I would even say if you do crypto and need cloud storage then store it in multiple places and avoid git. Better flat file and some daily backup strategy with e.g. encfs as the bottom layer. In worst case you get your data back. Sorry keybase.... you are not a trustable cloud storage for me. It feels like betting on your company... I want to bet on your company without feeling dependent on worst case restore scenarios (computer dying while your company dies).
- stephth 9y ago
  > I want to bet on your company without feeling dependent on worst case restore scenarios If you’re worried about Keybase disappearing with all your data, doesn’t backing up your computer cover that scenario?
- eridius 9y ago
  > But for the storing part alone I would not trust Keybase. Why not? You're making a bunch of claims about this being bad but you're not providing any reasoning for it.
  - therealmarv 9y ago
    It's basically new closed source one bucket crypto on one company which is not known for storage. A little bit too much of uncertainty for my taste.
    - kristianp 9y ago
      A large portion of their code is open source: https://github.com/keybase https://github.com/keybase
      - sigjuice 9y ago
        How easy is it to build and run my own copy of this code, especially the server side stuff?
RKlophaus 9y ago
For anyone interested in alternatives, we built a utility (creatively named git-gpg) with the same goal: end-to-end encrypted git. It works over ssh, is self-hosted, and requires no additional software on the shared server. https://github.com/glassroom/git-gpg https://github.com/glassroom/git-gpg
hollander 9y ago
Does this work for a local repository?
WindowsFon4life 9y ago
If only their app did not have so many pages marked writable and executable...
gigatexal 9y ago
This is really friggin' cool! Best of luck to you guys, hope the work continues.
jancsika 9y ago
> Keybase team member here. Interesting fact: git doesn't check the validity of sha-1 hashes in your commit history. Not sure I understand. git clone blah cd blah git fsck What am I missing?
jack12 9y ago
This is exciting, but I'm new to Keybase and don't entirely understand it yet. How can I clone a Keybase-hosted repository on a remote server? Can gpg-agent proxy through ssh similarly to ssh-agent to allow access to GPG keys (and is that what keybase uses?), without having to store my keys on the remote server? Or would I need to create a new Keybase account just for the remote server, with that account's private keys stored on the server but at least segregated from my account's full access to communication, team-management, etc? Or would the best approach be to clone the Keybase-hosted repository locally and then push it to the remote server over SSH?
- ptspts 9y ago
  Yes, probably you need a new Keybase account just for that remote server if you want the remote server be able to do git pull after the initial git clone. If all you need is a single git clone, and you already have a Keybase account, just do a git clone locally, and use rsync to upload the result to the remote server.
kazinator 9y ago
These benefits can be obtained by sharing a remote encrypted filesystem, in which sits an ordinary git repo. Then simply check out that git repo using a file://path/to/repo reference, creating a clone on a local drive out of the encrypted volume. The encrypted filesystem can then reside on an untrusted server in the cloud. Ultimately, this is a cleaner solution than the whack-a-mole approach of hacking every application one by one to retrofit it with crypto storage capabilities.
- timvdalen 9y ago
  As I understand it, that's pretty much was Keybase has done here. They have their encrypted filesystem, and this is a git remote helper for accessing that in a nice way (with access control built in on the fs layer).
- timerol 9y ago
  This question has a FAQ entry near the bottom of TFA: > Why not just make a bare repo in KBFS? The Keybase filesystem journals changes and syncs them after writes, kind of like Dropbox. Which means you and another team member could be fighting each other and make a conflicted HEAD, where there'd be 2 copies side by side. Similarly, you shouldn't put git repos in Dropbox. Keybase's git prevents this by locking. Also: it's nicer to use the Keybase app to discover and manage your teams' repositories.
  - deleted 9y ago
    [deleted]
voanhduy1512 9y ago
Thanks for nice product. From now on I will move all my git repo into keybase
earlybike 9y ago
I could basically store all my sensitive data there? Passwords, SSNs, private keys of ETH wallets, etc.?
- aeorgnoieang 9y ago
  Yes
dorfsmay 9y ago
I'm confused. Is the entire repo encrypted, or some files only? If the former, what are case where this is needed?
- aeorgnoieang 9y ago
  The entire repo is encrypted. Consider a repo containing passwords. It's easy enough to encrypt the files containing the passwords but the names of the files or even the directories in which they're located are also info you might wish to hide, e.g. that you have an account at some-site-you-do-not-want-anyone-to-know-you-visit.com.
ris 9y ago
Keybase, please just support web of trust already. In some way. Not everyone I want to be able to authenticate necessarily has public social media accounts.
- JBiserkov 9y ago
  Do they have a website/server? #1. Host a file on your site You can host a text file, such as yoursite.com/keybase.txt. This is preferred, if you have a website. #2. Set a DNS TXT record Instead of hosting a web page, you can place a keybase proof in your DNS records.
  - ris 9y ago
    > Do they have a website/server? Not necessarily. I'm talking about people who want to remain anonymous (or pseudonymous) and might want to keep as low a public online profile as possible.
- Nala_Alan 9y ago
  They support PGP, so you can use this.
  - mrsteveman1 9y ago
    They support PGP keys, but I don't think anything in the keybase UI or proofs will reflect key certifications made in PGP's web of trust. You can "track" people, but that's not the same thing. It should be possible to augment the existing proofs with the WoT relationships, which could be valuable in a small number of cases. However, it wouldn't surprise me if more people started using Keybase because of this one blog post, than have ever used PGP's web of trust features.
payomdousti 9y ago
is there some way to verify what was actually uploaded, and that it was indeed encrypted properly?
- ptspts 9y ago
  You can ask the same question about copying the .git directory with rsync over SSH, and the answer for that one applies to your original qustion as well: * You can take a look at the packets (using e.g. tcpdump). * You can take a look at what the binaries (rsync, ssh vs. keybase and git-remote-keybase) read and write (using e.g. strace). * You can read the source code. * You can read the white papers and other analyses about the crypto used, and decide if you trust it. The average user probably won't bother with these, because they need time, effort and experience. If you can imagine a fundamentally better possible way for the average user to verify crypto, please let us know.
payomdousti 9y ago
is there a way to view / verify that the payload has actually been encrypted?
TomasHubelbauer 9y ago
This is amazing. I've been aware of KeyBase for some time now, but never really explored it. This is the push. Typing this comment as I am setting up my proofs.
LeicaLatte 9y ago
Fantastic!
iamthirsty 9y ago
This actually got me to signup for Keybase today.
ams6110 9y ago
Remember, it is impossible to delete cloud data with any kind of confidence, and your host may already be compromised. Should be the epitaph of the current era of computing.
AdrianRossouw 9y ago
The two most interesting companies in crypto for me right now are KeyBase, and Wire. I kind of wish there was some way for them to interact with each other, because it feels like they each have a piece of some bigger puzzle.
- choosegoose 9y ago
  Are you not concerned with the data Wire collects? https://news.ycombinator.com/item?id=14069674 https://news.ycombinator.com/item?id=14069674 Versus the data Signal collects: https://signal.org/bigbrother/eastern-virginia-grand-jury/ https://signal.org/bigbrother/eastern-virginia-grand-jury/ Although I agree Wire looks like a much more (visually) polished chat service, it seems like they (Wire) collect more data than is necessary.
  - AdrianRossouw 9y ago
    Wire has open sourced it's server code (gplv3 even) and is working on federation support : https://medium.com/@wireapp/wire-server-code-now-100-open-source-the-journey-continues-88e24164309c https://medium.com/@wireapp/wire-server-code-now-100-open-so... So you can run your own copy of it, and be in complete control of any information it collects.
    - choosegoose 9y ago
      That seems really exciting. When that occurs I will most likely switch over. Unfortunately you can't quite host it your self yet: https://github.com/wireapp/wire-server/issues/2 https://github.com/wireapp/wire-server/issues/2
ex3ndr 9y ago
Was expected one question but haven't found one: how it is actually encrypted? Any whitepaper or information how diffs could be handled over encrypted data? Or it is a just encrypted .git folder?
- pfg 9y ago
  Looks like it's built on top of kbfs[1]. [1]: https://keybase.io/docs/kbfs/understanding_kbfs https://keybase.io/docs/kbfs/understanding_kbfs
  - FullyFunctional 9y ago
    The "actually encrypted" part is NaCL (ED25519 + sha256) as supported by Go [2]. Interestingly, the common way to use NaCL applies Curve25519 to encrypt a symmetric key which is the used for the payload. They don't do that. AFAICT, everything is using the ECC curve. [2] https://keybase.io/docs/crypto/kbfs https://keybase.io/docs/crypto/kbfs
  - RasputinsBro 9y ago
    So they've rolled out their own encryption?
aauthespian 9y ago
http://www.aauthespian.news/2017/10/why-are-some-nigerian-mothers.html http://www.aauthespian.news/2017/10/why-are-some-nigerian-mo...
jboynyc 9y ago
I made a test repository and proceeded to clone it using the keybase:// uri, expecting it not to work, but by some dark magic, it just did. Impressive!
- pqs 9y ago
  Not in my case. $:~/projectes$ git clone keybase:// [uri] Cloning into 'something'... fatal: I don't handle protocol 'keybase' I'm on an ubuntu machine. What can I do to solve the problem? Keybase version 1.0.34-20171006000413+5fe91ae13
  - jboynyc 9y ago
    Have you installed and are you running the keybase client software? I start it on my system (Arch Linux) using the run_keybase command.
squashmode 9y ago
My thanks to the keybase crew, I've waited for a practical PGP solution for nearly 20 years. Keybase delivers, thank you!
deleted 9y ago
[deleted]
theptip 9y ago
Has anyone seen a security audit of the Keybase platform? I love the product from a usability perspective, but have no idea if it's actually a safe repository for my team's key material.
FullyFunctional 9y ago
Let me be unoriginal and sing your praises also. I'd LOVE to replace my use of Dropbox with Keybase, but I pretty much use every single feature of the iOS Dropbox App [1] and Keybase really isn't an alternative right now. Also, one unique design choice of Dropbox is to use the underlying file system which means that working out of a Dropbox folder is native speed, even for high intensity IO. Keybase is a lot better than, say, Wuala was, but it's still noticeable. [1] In prioritized order: camera uploads, viewing and editing plaintext, show photos, playing music and video, uploading to Dropbox from random other iOS apps, and finally selective offline access.
Zynjec 9y ago
This is awesome, thanks for the heads up.
- simonRedwards 9y ago
  Yup! Definitely not just posting this to verify myself.
daveheq 9y ago
Just wait til the government bans this because people will store kiddie porn, terrorist communications, and copyrighted media into it.
- sorokod 9y ago
  "Just wait til the government bans this because people will store kiddie porn, terrorist communications, and copyrighted media into it." More precisely, the government will claim that ...
rcthompson 9y ago
It's amazing how many new features and even new complete products Keybase has been able to build on top of their core in such a short span of time. Even more so considering that a large part of that core is "just" a much better UX for a technology (GPG) that has existed for decades.
hasenj 9y ago
Wait, what exactly _is_ keybase? The home page says: > Keybase is a new and free security app for mobile phones and computers. ok, so, what does it do? > For the geeks among us: it's open source and powered by public-key cryptography. Still have no idea what it does .. > Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server can't leak your files or be hacked. ok, so what is it? what does it do? > [picture that looks like a chat app] So it's an encrypted chat server? What is it? How can you have a homepage for a product that doesn't talk about what the product is and what it does? Why so obscure? Are you trying to hide something? Is this really a home page for a product aimed at people who care about security? Compare it to, for example, tarsnap's[0] homepage, which explains exactly what the product does and doesn't leaving you wondering about anything. [0]: https://www.tarsnap.com/ https://www.tarsnap.com/
- taneq 9y ago
  It's Jabberwocky.
- OJFord 9y ago
  It's a lot, isn't your third quote a pretty good description? > Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server can't leak your files or be hacked. It's not much of a reach to assume familiarity with Slack and Dropbox; the message is clearly that Keybase is those (via Keybase Chat & FS) but encrypted. For what it's worth, it's also a keyserver, and (now) git remote.
  - hasenj 9y ago
    > isn't your third quote a pretty good description? It's not. I think the person who wrote it think it's good marketing, but even that, it is not. Here, try to see if this makes any sense as a product description: > FeedHamster is for anyone! Imagine a Yelp that's customized just for you! Or a YouTube feed that only shows you interesting videos that _you_ would like! > Install FeedHamster now! Now, can you guess what FeedHamster does? Maybe it curates content? Honestly I have no idea. I just made it up. It doesn't really say anything useful at all, but I think it makes more sense that that description on Keybase's website.
ryanqian 9y ago
I have a long running vm on Google cloud with only tiny configuration. I communicate to it with strong crypt way to access my 'pass' s git repo. So far so good, but I'm good to see what keybase's good work on how to improve the personal data safety, that's a good choice.
patrick_haply 9y ago
Nice, this is perfect timing for me to see this actually. I've been slowly building out a little cli tool that I use to track .env files (and other files that you don't want to check into source) in a git repository that is parallel to your project's git repository. The way it works is you identify a file that you don't want to check into source. The cli moves it to a parallel repo, commits the file to the parallel repo, and symlinks the file back to the original location. From then on, you get all of the normal source control features like local changes, revision history, etc... that you get with every other file in your project. I basically got fed up with "crap what was that value I was using before? Let me dig through my credentials store" or resorting to commenting out old lines just in case I needed to revert. So far, I've just been keeping those parallel repositories local for lack of an encrypted remote to push to. Definitely checking this out.
zrg 9y ago
I give gitlab 2 months before they implement and launch encrypted git
feelin_googley 9y ago
Does it use libgcrypt? https://www.theregister.co.uk/2017/07/04/gnupg_crypto_library_cracked_look_for_patches/ https://www.theregister.co.uk/2017/07/04/gnupg_crypto_librar... Maybe it only uses the Go crypto libraries?
ValentineC 9y ago
From the article: >> What are the limits? > You can have as many repositories as you want, but the total for your personal repositories can't exceed 100GB. Each team also gets 100GB. Is there anything stopping people from creating team after team just to hoard data in Keybase?
ptspts 9y ago
On Linux, you can try this encrypted Git without installing Keybase or using the Keybase GUI. You need the following Go binaries from keybase*.deb: keybase, git-remote-keybase and kbfsfuse. Start kbfsfuse (specify a directory as a mount point); put get-remote-keybase to your $PATH; run keybase git create myrepo; you can stop kbfsfuse now; then this works (after substituting $KEYBASEUSER): git clone keybase://private/$KEYBASEUSER/myrepo
traitormonkey 9y ago
I don't trust Keybase.
ryanpcmcquen 9y ago
This is amazing and convinced me to install Keybase on all my comps. I would like the ability to browse the repo in the Keybase app though.

1427 points by aston 9y ago

I don't really understand how it works. Are the git objects encrypted before being pushed? In that case how are they handled by the server? Does it accept them even though they make no sense? What Github is going to show?

mrsteveman1 9y ago
Keybase is just another Git remote you can push to, one that transparently encrypts whatever is pushed to that remote. The Git repo itself is completely normal in every other respect, so if you push to Github, everyone can still see the entire repo. This is a good design as it lets people move repos easily and avoid too much lock-in, but it may (will...) come back to bite people soon, who push things to Github thinking they were "encrypted by Keybase", which is not what's going on.

malgorithms 9y ago

Keybase team member here. Interesting fact: git doesn't check the validity of sha-1 hashes in your commit history. Meaning if someone compromises your hosted origin, they can quietly compromise your history. So even the fears about data leaks aside, this is a big win for safety. From an entrepreneurial perspective, this is my favorite thing we've done at Keybase. It pushes all the buttons: (1) it's relatively simple, (2) it's filling a void, (3) it's powered by all our existing tech, and (4) it doesn't complicate our product. What I mean by point 4 is that it adds very little extra UX and doesn't change any of the rest of the app. If you don't use git, cool. If you do, it's there for you. What void does this fill? Previously, I managed some solo repositories of private data in a closet in my apartment. Who does that? It required a mess: uptime of a computer, a good link, and dynamic dns. And even then, I never could break over the hurdle of setting up team repositories with safe credential management...like for any kind of collaboration. With this simple screen, you can grab 5 friends, make a repo in a minute, and all start working on it. With much better data safety than most people can achieve on their own.

Foxboron 9y ago
While talking about git and security: Signing tags are not as affective as you'd think. refs are never actually signed, it's the objects they are pointing at that are signed. This opens up to interesting attacks where you can move refs around to previous vulnerable versions. Git also never checks if the metadata the tag points at is correct! Interesting paper: https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_torres-arias.pdf https://www.usenix.org/system/files/conference/usenixsecurit...
- im_down_w_otp 9y ago
  Yeah, we implemented this paper's proposal (their version has some bugs, gaps, and infinite loop issues) where I work to be able to have higher assurance on the validity of our source repositories. First version in shell with a fairly robust test suite, and the next version in Rust. Originally started to do it in Rust, but libgit2 was sufficiently obtuse that we opted for getting to a complete, working thing first.
ianleeclark 9y ago
For your first point, can't you verify the signature for the commit? In order to to compromise the origin, they must also compromise the secret key of whoever is signing commits. I say that in full realization that 99% of people probably don't even know that you can sign commits, but the first point doesn't seem valid, as you can ensure integrity of commit history.
gaxun 9y ago
> hurdle of setting up team repositories with safe credential management...like for any kind of collaboration Identity continues to be the key selling point of keybase. I'm excited by this. I can keep clones of my private repositories here. Things like dotfiles and configurations. That sounds like a good start. And I can also easily share code to people who need to see it.
mikeash 9y ago
This looks sweet. I bounce between using Bitbucket or Dropbox for private repos depending on my needs. Bitbucket has lots of features but is a little annoying to set up a new project. Dropbox is really easy but doesn't always work well (e.g. git push ends up being effectively async). Your version of it looks to be just as easy as Dropbox, maybe even easier, but without any of the downsides. And it's encrypted!

zeroxfe 9y ago

I'm really happy about this. I have private repos for personal information (e.g., tax spreadsheets going back a decade) that I keep synchronized across machines, and have to jump through hoops to get an encrypted authoritative remote source. Right now I do that with an encrypted partition on a private VM. And, it really sucks that GitHub does not encrypt data at rest: --- SNIP from https://help.github.com/articles/github-security https://help.github.com/articles/github-security --- We do not encrypt repositories on disk because it would not be any more secure: the website and git back-end would need to decrypt the repositories on demand, slowing down response times. Any user with shell access to the file system would have access to the decryption routine, thus negating any security it provides. Therefore, we focus on making our machines and network as secure as possible. --- SNIP --- Encrypted disks are now the norm across various cloud providers, as is HTTPS. The crypto overheads are really low, and their benefits significantly outweigh the risks of leaving clear-text data on disks. Also, defense-in-depth is always worth pursuing. The claim "it would not be any more secure", is so far from true, it's almost insulting to their target audience. Keep killin' it, Keybase! Great job!

yorick 9y ago
Out of curiosity, what are the benefits you're talking about?
eslaught 9y ago
It certainly depends on the threat model, but in this case I have to agree with Github---adding at-rest encryption would be unlikely to make their product significantly more secure, and it would certainly be nowhere as secure as Keybase. With Keybase, the data is encrypted on the client, and the keys stay on the client. Assuming the crypto is done right, there is fundamentally no way for Keybase to read the data, and therefore no way for an attacker to get the data by way of compromising Keybase. The only way for an attacker to get the data is by compromising the client machine, which is a very different threat model. With the model you're proposing for Github, the data would be encrypted for transfer (via HTTPS or SSH), but then it would be immediately decrypted again on the server. Even if it is encrypted again before it's put onto the disk, fundamentally the key lives on the server (and has to in order to provide Github's feature set) and so an attacker who had compromised the machine would simply grab the key before going after the files on disk. The actual additional security you get is really not that significant. Personally, I appreciate Github's stance on this. There have been a number of "secure" products (see e.g. Lavabit) that have really been snakeoil because they used the approach above. I'll take honesty over false promises any day---at least with the former, I understand my risk and can take steps to mitigate appropriately.

j7ake 9y ago

Hi security newbie here, I have private bitbucket repo for storing my pass data. One problem is that pass often leaks some metadata like headers of directories. From security standpoint does this mean it is more private to host the git repo on keybase versus bitbucket ?

jredmond 9y ago
That depends - is that data encrypted on your system? Since git is decentralized, there's a chance that any plain-text copy (such as a clone on your system) could be compromised. Keybase even addresses this in the FAQ, to an extent: > What if my computer is compromised? > Your work is only as safe as your endpoints, so we can't help you there. This applies regardless of host or protocol, BTW, and it isn't even specific to computing. (It doesn't matter how many locks you have on your front door if you leave the back door propped open.)
- j7ake 9y ago
  Hi pass uses gpg encryption on the text files my only concern are the file names which can leak meta info, for example just searching GitHub https://github.com/zurchpet/pass https://github.com/zurchpet/pass shows this person has passwords in a public repository but encrypted. Nevertheless I can see that the file names are credit card info and other sensitive info. It's like having a safe with a label "important stuff inside" ! Does keybase solve this problem ?
  - tanderson92 9y ago
    Yes, the contents of the git repository holding your pass files are encrypted, meaning that the file names are not visible to anyone without the private key (you). You may also want to look at https://github.com/roddhjav/pass-tomb https://github.com/roddhjav/pass-tomb
    - j7ake 9y ago
      Thanks for that I'll consider it.

tln 9y ago

This is pretty cool. I've used git-crypt before to encrypt parts of a repo, but this approach seems much easier to manage. https://github.com/AGWA/git-crypt https://github.com/AGWA/git-crypt

elahd 9y ago

This is excellent. I've been looking for practical uses for my Keybase account -- it's been sitting around, verified but idle for years. The chat app is nice, but none of my friends or co-workers use the service (or understand crypto, for that matter).

NikolaeVarius 9y ago

My first initial gut thought is, could this be as a good ol cross platform method of password management? I've never been able to properly manage keepass due to syncing between different platforms being a pain.

tehno 9y ago
Maybe combine Keybase git with gopass, that one stores data in a git repo: https://www.justwatch.com/gopass/#features https://www.justwatch.com/gopass/#features
- NikolaeVarius 9y ago
  That sounds promising. I can't be the only one with this problem. (aka secure cross platform synchronized password management without requiring personal/managing cloud infrastructure.
stevenleeg 9y ago
https://www.passwordstore.org/ https://www.passwordstore.org/ This might be exactly what you're looking for :)
raesene9 9y ago
https://github.com/kbsecret/kbsecret https://github.com/kbsecret/kbsecret is Secrets management back by Keybase :)
woodruffw 9y ago
This is something that I've been working on for about a year using Keybase[1]. [1]: https://github.com/kbsecret/kbsecret https://github.com/kbsecret/kbsecret
eridius 9y ago
I've had nothing but good experiences using 1Password.
- NikolaeVarius 9y ago

ericfrederich 9y ago

Awesome... any plans to support LFS? I know with LFS you can write custom backend handlers.

markdog12 9y ago
First thing I thought of too. Would be an awesome feature. Edit: Just tried and no dice: 'Remote "origin" does not support the LFS locking API.'
sridvijay 9y ago
Was just thinking that as well, the hard part about changing GitHub hosts like bitbucket/github is the feature parity between them. This is really enticing though.

philip1209 9y ago

Some hypothetical questions: - How could CI/CD be set up? (Is read-only access possible to the repo? Would Keybase work on a Jenkins box? Could a deploy server verify signatures before deploying?) - Could one set up mirroring to GitHub? How would this work? (I could see the signing without encryption as a value-add) - What happens in the event of a force push? Could certain users destroy history? - Could protected branches eventually be added, eg only certain users can push to master?

strib 9y ago
> - How could CI/CD be set up? (Is read-only access possible to the repo? Would Keybase work on a Jenkins box? Could a deploy server verify signatures before deploying? You could have a deploy/CI user as a "reader" in your team. But we don't yet support hooks or anything (as that implies running arbitrary code on endhosts without their knowledge), so it would have to pull the repo. > Could one set up mirroring to GitHub? How would this work? (I could see the signing without encryption as a value-add) You can of course continue to use Github as a regular remote, but you'd lose all the encryption and signing unfortunately. > - What happens in the event of a force push? Could certain users destroy history? We do currently allow force pushes. Being able to turn that off on a repo-by-repo basis is something we'll consider in the future, definitely. > Could protected branches eventually be added, eg only certain users can push to master? Yes, but again, as with any "server"-side feature, this is complicated by the fact that it has to run on the client itself, and thus isn't really strictly enforceable against modified clients. As we get more experience with people using this, we will definitely be thinking about how to make it better by adding power features like these. Thanks for the feedback!

ericfrederich 9y ago

This removes the ability for collaborating, browsing online, basically any feature of GitLab/GitHub/BitBucket. ... I think I'm in favor of this. I think of the things that those services provide on top of Git should actually be ported or mapped to Git itself. Branches, pull requests, comments, etc... should all be Git objects of some sort.

quadrangle 9y ago
Branches are Git objects. Incidentally, here's a distributed VCS that includes bug tracking: https://fossil-scm.org https://fossil-scm.org
- falsedan 9y ago
  > Branches are Git objects That's not how I understand refs, they don't even live in the .git/objects hierarchy.
  - ericfrederich 9y ago
    You're correct, they're just files. To create a new branch off of master you can just... cp .git/refs/heads/master .git/refs/heads/WTFFF ... no SHA-1 involved at all, no parent, history, etc.
    - swsieber 9y ago
      However what they point to are git objects. And being pointed to prevent them from being garbage collected (pruned).
  - quadrangle 9y ago
    I guess I don't understand what GitHub/GitLab does that makes branches different from Git itself (which seemed to be the claim I was replying to).
    - falsedan 9y ago

chishaku 9y ago

In case you're wondering... > ~ Anticipated q's ~ > What if we're living in a simulation? > Keybase offers no guarantees against sophisticated side-channel attacks by higher-level entities.

rotrux 9y ago
> ~ Anticipated A's ~ > YES. IT'S LIKE THE MATRIX BUT INSTEAD OF ROBOTS IT'Z LIZARD PEOPLE. > THIS ISN'T A QUESTION BUT GOOD POINT. WE R BEGINNING THE MOVE UNDERGROUND.
seanlane 9y ago
It appears that this may no longer be an open question: http://www.pbs.org/wgbh/nova/next/physics/physicists-confirm-that-were-not-living-in-a-computer-simulation/ http://www.pbs.org/wgbh/nova/next/physics/physicists-confirm... There was a Hacker News post about this a few days ago, likely from a different source, but I can't find it.
- rorosaurus 9y ago
  Doesn't this simply suggest that the reality that is simulating our universe would have to be fundamentally different than our own?
- jsjohnst 9y ago
  I remember reading something a decade or so ago which said that to simulate the entire known universe, even using selective windowing, would require more energy than the entire universe has. Wish I could remember the source.
- qudat 9y ago
  This only applies to classical computers not quantum, some combination of both, or by some means of computation we haven't discovered yet.
- rvern 9y ago
  No: https://www.scottaaronson.com/blog/?p=3482 https://www.scottaaronson.com/blog/?p=3482.

falsedan 9y ago

Nice to see people work on git remote helpers, a shame that there's already a fine remote helper that is not tied to a specific hosting provider & uses GPG[0] already. 0: https://spwhitton.name/tech/code/git-remote-gcrypt/ https://spwhitton.name/tech/code/git-remote-gcrypt/

zeveb 9y ago
I came here precisely to see how this compares to git-remote-gcrypt (which I use to protect my password-safe filenames). Anyone from keybase prepared to comment?
- ptspts 9y ago
  I'm not a Keybase developer, but I'm a user of Keybase Git, git-remote-gcrypt and git-gpg, and I've just written a comparison of the 3. Here you are: http://ptspts.blogspot.com/2017/10/comparison-of-encrypted-git-remote.html http://ptspts.blogspot.com/2017/10/comparison-of-encrypted-g... If I missed some of the aspects, please let me know.
nimnio 9y ago
Could you explain what's a shame? I'm having trouble guessing your point.

OrangeTux 9y ago

Keybase has quite a few interesting and unique features. But I'm cautious, because it's not clear to me how they are going to monetize it.

notheguyouthink 9y ago

As an aside, does key base offer tools to encrypt data from code, lets say from Python/Go/Rust/etc, that is moron proof? I say tools, because while a library would be cool, I'd understand if it was a binary/application to provide the functionality/user-experience that key base is aiming for. I know this likely doesn't sound like something key base should be aiming for, but to me, programmers need encryption just as much as users. I'd like to write my libraries/programs with encryption, but I also want to be able to trust it and not fear some inherent vulnerability I'm adding. To me, Keybase is aiming to solve/reduce these complexities for users, and I'm hoping they also aim to solve it for developers to. Thanks for all the hard work folks @ Keybase, it's definitely appreciated!

danenania 9y ago
Go has a good openpgp package: https://godoc.org/golang.org/x/crypto/openpgp https://godoc.org/golang.org/x/crypto/openpgp I wouldn't say it's foolproof though. I agree that simpler, higher-level libraries are needed across the board.
edraferi 9y ago
Keybase has a public API [0]. There's a community Python library, but it appears to be unmaintained [1]. [0] https://keybase.io/docs/api/1.0/intro https://keybase.io/docs/api/1.0/intro [1] https://github.com/adamldoyle/python-keybase-client https://github.com/adamldoyle/python-keybase-client
hamandcheese 9y ago
Check out libsodium/nacl. Go has an implementation of the box api[0] which is pretty foolproof. There are bindings and/or implementations in many languages. [0]: https://godoc.org/golang.org/x/crypto/nacl https://godoc.org/golang.org/x/crypto/nacl
ofek 9y ago
This is a perfect use case for https://github.com/ofek/privy https://github.com/ofek/privy

phren0logy 9y ago

I really like keybase, and I wish they could issue certs for me to sign PDFs. I would pay for that.

hdhzy 9y ago

Sounds intriguing but I'm missing the deep technical info on how it works. > All data you push is signed by your device's private key, which never leaves your device. For the reference git already supports signed pushes (git push --signed): https://github.com/git/git/commit/a85b377d0419a9dfaca8af2320cc33b051cbed04 https://github.com/git/git/commit/a85b377d0419a9dfaca8af2320...

welder 9y ago
Signing a commit does not encrypt that commit's contents, just adds a signature to prove you wrote that commit. From the Keybase FAQ: > So is this signing my commits? > No, this is happening at a lower level, (1) to allow encryption, and (2) to ensure no unsigned or unencrypted data makes it in. Intuitively you can think of it as you and your teammates using a cryptographic secure storage layer for your git origin that doesn't really understand git. > Your commits themselves are untouched from git's perspective, so if you mirror your repository elsewhere, it'll be a regular checkout.
- hdhzy 9y ago
  I did not mention signing commits but signing push requests and that was a reference to: > All data you push is signed by your device's private key, which never leaves your device.

Walkman 9y ago

I have a private repo on GitHub which contains my dotfiles with SSH private keys, tokens, secrets and all kinds of secret stuff. I was uncomfortable storing it there, but my laziness/lack of time kept it there. Finally I will be able to encrypt the entire repo, yay!!

philsnow 9y ago
if you're uncomfortable storing them there, you're going to rotate all the secrets after you move the repo to keybase, right?
- Walkman 9y ago
  Yes, I will. That's a long overdue also :D
hasenj 9y ago
did you delete the unencrypted repo from github? actually even if you did, a version of it might still be lurking in some corner. Maybe time to create a new set of private keys?

adiosdfisndf 9y ago

Tried to create an account and no matter what I tried to name my devices all I got was "keybase has reserved this name." Welp.

cjbprime 9y ago
Ah, it's not the device names that are reserved, it's the username itself.

paule89 9y ago

just to clarify: 1. Do you need a private git repository? 2. Is everything really encrypted? 3. If everything is encrypted how can i access it through Git Desktop?

pkd 9y ago
From what I understood (I haven't actually used the product), the repository is in the decrypted state on your local machine and is fully encrypted while being stored on the remote.
netcraft 9y ago
re: #1 I just tried it - they are giving you an encrypted git remote. So you create a new repo with them, then you can clone it somewhere (or add it as a remote) and push to it.
nickik 9y ago
Git repository are private for you or for a team that you select. Yes, everything is encrypted on your machine locally.
strib 9y ago
You can have team-based or private repos hosted by Keybase. Everything is encrypted and signed before it leaves your computer, and decrypted and verified when your computer downloads it. But your local checkout of that git repo is unencrypted. It's just a normal repo. So Github Desktop has full access to it, like it does for all files in your local filesystem.

therealmarv 9y ago

If you go crypto don't use git. It's not designed for cryptography in mind and the Keybase approach looks nice IF I can control every chain or can keep using github (or any other git server) with it. But for the storing part alone I would not trust Keybase. I would even say if you do crypto and need cloud storage then store it in multiple places and avoid git. Better flat file and some daily backup strategy with e.g. encfs as the bottom layer. In worst case you get your data back. Sorry keybase.... you are not a trustable cloud storage for me. It feels like betting on your company... I want to bet on your company without feeling dependent on worst case restore scenarios (computer dying while your company dies).

stephth 9y ago
> I want to bet on your company without feeling dependent on worst case restore scenarios If you’re worried about Keybase disappearing with all your data, doesn’t backing up your computer cover that scenario?
eridius 9y ago
> But for the storing part alone I would not trust Keybase. Why not? You're making a bunch of claims about this being bad but you're not providing any reasoning for it.
- therealmarv 9y ago
  It's basically new closed source one bucket crypto on one company which is not known for storage. A little bit too much of uncertainty for my taste.
  - kristianp 9y ago
    A large portion of their code is open source: https://github.com/keybase https://github.com/keybase
    - sigjuice 9y ago
      How easy is it to build and run my own copy of this code, especially the server side stuff?

RKlophaus 9y ago

For anyone interested in alternatives, we built a utility (creatively named git-gpg) with the same goal: end-to-end encrypted git. It works over ssh, is self-hosted, and requires no additional software on the shared server. https://github.com/glassroom/git-gpg https://github.com/glassroom/git-gpg

hollander 9y ago

Does this work for a local repository?

WindowsFon4life 9y ago

If only their app did not have so many pages marked writable and executable...

gigatexal 9y ago

This is really friggin' cool! Best of luck to you guys, hope the work continues.

jancsika 9y ago

> Keybase team member here. Interesting fact: git doesn't check the validity of sha-1 hashes in your commit history. Not sure I understand. git clone blah cd blah git fsck What am I missing?

jack12 9y ago

This is exciting, but I'm new to Keybase and don't entirely understand it yet. How can I clone a Keybase-hosted repository on a remote server? Can gpg-agent proxy through ssh similarly to ssh-agent to allow access to GPG keys (and is that what keybase uses?), without having to store my keys on the remote server? Or would I need to create a new Keybase account just for the remote server, with that account's private keys stored on the server but at least segregated from my account's full access to communication, team-management, etc? Or would the best approach be to clone the Keybase-hosted repository locally and then push it to the remote server over SSH?

ptspts 9y ago
Yes, probably you need a new Keybase account just for that remote server if you want the remote server be able to do git pull after the initial git clone. If all you need is a single git clone, and you already have a Keybase account, just do a git clone locally, and use rsync to upload the result to the remote server.

kazinator 9y ago

These benefits can be obtained by sharing a remote encrypted filesystem, in which sits an ordinary git repo. Then simply check out that git repo using a file://path/to/repo reference, creating a clone on a local drive out of the encrypted volume. The encrypted filesystem can then reside on an untrusted server in the cloud. Ultimately, this is a cleaner solution than the whack-a-mole approach of hacking every application one by one to retrofit it with crypto storage capabilities.

timvdalen 9y ago
As I understand it, that's pretty much was Keybase has done here. They have their encrypted filesystem, and this is a git remote helper for accessing that in a nice way (with access control built in on the fs layer).
timerol 9y ago
This question has a FAQ entry near the bottom of TFA: > Why not just make a bare repo in KBFS? The Keybase filesystem journals changes and syncs them after writes, kind of like Dropbox. Which means you and another team member could be fighting each other and make a conflicted HEAD, where there'd be 2 copies side by side. Similarly, you shouldn't put git repos in Dropbox. Keybase's git prevents this by locking. Also: it's nicer to use the Keybase app to discover and manage your teams' repositories.
- deleted 9y ago
  [deleted]

voanhduy1512 9y ago

Thanks for nice product. From now on I will move all my git repo into keybase

earlybike 9y ago

I could basically store all my sensitive data there? Passwords, SSNs, private keys of ETH wallets, etc.?

aeorgnoieang 9y ago
Yes

dorfsmay 9y ago

I'm confused. Is the entire repo encrypted, or some files only? If the former, what are case where this is needed?

aeorgnoieang 9y ago
The entire repo is encrypted. Consider a repo containing passwords. It's easy enough to encrypt the files containing the passwords but the names of the files or even the directories in which they're located are also info you might wish to hide, e.g. that you have an account at some-site-you-do-not-want-anyone-to-know-you-visit.com.

ris 9y ago

Keybase, please just support web of trust already. In some way. Not everyone I want to be able to authenticate necessarily has public social media accounts.

JBiserkov 9y ago
Do they have a website/server? #1. Host a file on your site You can host a text file, such as yoursite.com/keybase.txt. This is preferred, if you have a website. #2. Set a DNS TXT record Instead of hosting a web page, you can place a keybase proof in your DNS records.
- ris 9y ago
  > Do they have a website/server? Not necessarily. I'm talking about people who want to remain anonymous (or pseudonymous) and might want to keep as low a public online profile as possible.
Nala_Alan 9y ago
They support PGP, so you can use this.
- mrsteveman1 9y ago
  They support PGP keys, but I don't think anything in the keybase UI or proofs will reflect key certifications made in PGP's web of trust. You can "track" people, but that's not the same thing. It should be possible to augment the existing proofs with the WoT relationships, which could be valuable in a small number of cases. However, it wouldn't surprise me if more people started using Keybase because of this one blog post, than have ever used PGP's web of trust features.

payomdousti 9y ago

is there some way to verify what was actually uploaded, and that it was indeed encrypted properly?

ptspts 9y ago
You can ask the same question about copying the .git directory with rsync over SSH, and the answer for that one applies to your original qustion as well: * You can take a look at the packets (using e.g. tcpdump). * You can take a look at what the binaries (rsync, ssh vs. keybase and git-remote-keybase) read and write (using e.g. strace). * You can read the source code. * You can read the white papers and other analyses about the crypto used, and decide if you trust it. The average user probably won't bother with these, because they need time, effort and experience. If you can imagine a fundamentally better possible way for the average user to verify crypto, please let us know.

payomdousti 9y ago

is there a way to view / verify that the payload has actually been encrypted?

TomasHubelbauer 9y ago

This is amazing. I've been aware of KeyBase for some time now, but never really explored it. This is the push. Typing this comment as I am setting up my proofs.

LeicaLatte 9y ago

Fantastic!

iamthirsty 9y ago

This actually got me to signup for Keybase today.

ams6110 9y ago

Remember, it is impossible to delete cloud data with any kind of confidence, and your host may already be compromised. Should be the epitaph of the current era of computing.

AdrianRossouw 9y ago

The two most interesting companies in crypto for me right now are KeyBase, and Wire. I kind of wish there was some way for them to interact with each other, because it feels like they each have a piece of some bigger puzzle.

choosegoose 9y ago
Are you not concerned with the data Wire collects? https://news.ycombinator.com/item?id=14069674 https://news.ycombinator.com/item?id=14069674 Versus the data Signal collects: https://signal.org/bigbrother/eastern-virginia-grand-jury/ https://signal.org/bigbrother/eastern-virginia-grand-jury/ Although I agree Wire looks like a much more (visually) polished chat service, it seems like they (Wire) collect more data than is necessary.
- AdrianRossouw 9y ago
  Wire has open sourced it's server code (gplv3 even) and is working on federation support : https://medium.com/@wireapp/wire-server-code-now-100-open-source-the-journey-continues-88e24164309c https://medium.com/@wireapp/wire-server-code-now-100-open-so... So you can run your own copy of it, and be in complete control of any information it collects.
  - choosegoose 9y ago
    That seems really exciting. When that occurs I will most likely switch over. Unfortunately you can't quite host it your self yet: https://github.com/wireapp/wire-server/issues/2 https://github.com/wireapp/wire-server/issues/2

ex3ndr 9y ago

Was expected one question but haven't found one: how it is actually encrypted? Any whitepaper or information how diffs could be handled over encrypted data? Or it is a just encrypted .git folder?

pfg 9y ago
Looks like it's built on top of kbfs[1]. [1]: https://keybase.io/docs/kbfs/understanding_kbfs https://keybase.io/docs/kbfs/understanding_kbfs
- FullyFunctional 9y ago
  The "actually encrypted" part is NaCL (ED25519 + sha256) as supported by Go [2]. Interestingly, the common way to use NaCL applies Curve25519 to encrypt a symmetric key which is the used for the payload. They don't do that. AFAICT, everything is using the ECC curve. [2] https://keybase.io/docs/crypto/kbfs https://keybase.io/docs/crypto/kbfs
- RasputinsBro 9y ago
  So they've rolled out their own encryption?

aauthespian 9y ago

http://www.aauthespian.news/2017/10/why-are-some-nigerian-mothers.html http://www.aauthespian.news/2017/10/why-are-some-nigerian-mo...

jboynyc 9y ago

I made a test repository and proceeded to clone it using the keybase:// uri, expecting it not to work, but by some dark magic, it just did. Impressive!

pqs 9y ago
Not in my case. $:~/projectes$ git clone keybase:// [uri] Cloning into 'something'... fatal: I don't handle protocol 'keybase' I'm on an ubuntu machine. What can I do to solve the problem? Keybase version 1.0.34-20171006000413+5fe91ae13
- jboynyc 9y ago
  Have you installed and are you running the keybase client software? I start it on my system (Arch Linux) using the run_keybase command.

squashmode 9y ago

My thanks to the keybase crew, I've waited for a practical PGP solution for nearly 20 years. Keybase delivers, thank you!

deleted 9y ago

[deleted]

theptip 9y ago

Has anyone seen a security audit of the Keybase platform? I love the product from a usability perspective, but have no idea if it's actually a safe repository for my team's key material.

FullyFunctional 9y ago

Let me be unoriginal and sing your praises also. I'd LOVE to replace my use of Dropbox with Keybase, but I pretty much use every single feature of the iOS Dropbox App [1] and Keybase really isn't an alternative right now. Also, one unique design choice of Dropbox is to use the underlying file system which means that working out of a Dropbox folder is native speed, even for high intensity IO. Keybase is a lot better than, say, Wuala was, but it's still noticeable. [1] In prioritized order: camera uploads, viewing and editing plaintext, show photos, playing music and video, uploading to Dropbox from random other iOS apps, and finally selective offline access.

Zynjec 9y ago

This is awesome, thanks for the heads up.

simonRedwards 9y ago
Yup! Definitely not just posting this to verify myself.

daveheq 9y ago

Just wait til the government bans this because people will store kiddie porn, terrorist communications, and copyrighted media into it.

sorokod 9y ago
"Just wait til the government bans this because people will store kiddie porn, terrorist communications, and copyrighted media into it." More precisely, the government will claim that ...

rcthompson 9y ago

It's amazing how many new features and even new complete products Keybase has been able to build on top of their core in such a short span of time. Even more so considering that a large part of that core is "just" a much better UX for a technology (GPG) that has existed for decades.

hasenj 9y ago

Wait, what exactly _is_ keybase? The home page says: > Keybase is a new and free security app for mobile phones and computers. ok, so, what does it do? > For the geeks among us: it's open source and powered by public-key cryptography. Still have no idea what it does .. > Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server can't leak your files or be hacked. ok, so what is it? what does it do? > [picture that looks like a chat app] So it's an encrypted chat server? What is it? How can you have a homepage for a product that doesn't talk about what the product is and what it does? Why so obscure? Are you trying to hide something? Is this really a home page for a product aimed at people who care about security? Compare it to, for example, tarsnap's[0] homepage, which explains exactly what the product does and doesn't leaving you wondering about anything. [0]: https://www.tarsnap.com/ https://www.tarsnap.com/

taneq 9y ago
It's Jabberwocky.
OJFord 9y ago
It's a lot, isn't your third quote a pretty good description? > Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server can't leak your files or be hacked. It's not much of a reach to assume familiarity with Slack and Dropbox; the message is clearly that Keybase is those (via Keybase Chat & FS) but encrypted. For what it's worth, it's also a keyserver, and (now) git remote.
- hasenj 9y ago
  > isn't your third quote a pretty good description? It's not. I think the person who wrote it think it's good marketing, but even that, it is not. Here, try to see if this makes any sense as a product description: > FeedHamster is for anyone! Imagine a Yelp that's customized just for you! Or a YouTube feed that only shows you interesting videos that _you_ would like! > Install FeedHamster now! Now, can you guess what FeedHamster does? Maybe it curates content? Honestly I have no idea. I just made it up. It doesn't really say anything useful at all, but I think it makes more sense that that description on Keybase's website.

ryanqian 9y ago

I have a long running vm on Google cloud with only tiny configuration. I communicate to it with strong crypt way to access my 'pass' s git repo. So far so good, but I'm good to see what keybase's good work on how to improve the personal data safety, that's a good choice.

patrick_haply 9y ago

Nice, this is perfect timing for me to see this actually. I've been slowly building out a little cli tool that I use to track .env files (and other files that you don't want to check into source) in a git repository that is parallel to your project's git repository. The way it works is you identify a file that you don't want to check into source. The cli moves it to a parallel repo, commits the file to the parallel repo, and symlinks the file back to the original location. From then on, you get all of the normal source control features like local changes, revision history, etc... that you get with every other file in your project. I basically got fed up with "crap what was that value I was using before? Let me dig through my credentials store" or resorting to commenting out old lines just in case I needed to revert. So far, I've just been keeping those parallel repositories local for lack of an encrypted remote to push to. Definitely checking this out.

zrg 9y ago

I give gitlab 2 months before they implement and launch encrypted git

feelin_googley 9y ago

Does it use libgcrypt? https://www.theregister.co.uk/2017/07/04/gnupg_crypto_library_cracked_look_for_patches/ https://www.theregister.co.uk/2017/07/04/gnupg_crypto_librar... Maybe it only uses the Go crypto libraries?

ValentineC 9y ago

From the article: >> What are the limits? > You can have as many repositories as you want, but the total for your personal repositories can't exceed 100GB. Each team also gets 100GB. Is there anything stopping people from creating team after team just to hoard data in Keybase?

ptspts 9y ago

On Linux, you can try this encrypted Git without installing Keybase or using the Keybase GUI. You need the following Go binaries from keybase*.deb: keybase, git-remote-keybase and kbfsfuse. Start kbfsfuse (specify a directory as a mount point); put get-remote-keybase to your $PATH; run keybase git create myrepo; you can stop kbfsfuse now; then this works (after substituting $KEYBASEUSER): git clone keybase://private/$KEYBASEUSER/myrepo

traitormonkey 9y ago

I don't trust Keybase.

ryanpcmcquen 9y ago

This is amazing and convinced me to install Keybase on all my comps. I would like the ability to browse the repo in the Keybase app though.