5 ms·

I have to say I am surprised and disappointed. Keybase has up until now been a shining example of doing crypto right but still accessible and easy to use. This

I have to say I am surprised and disappointed. Keybase has up until now been a shining example of doing crypto right but still accessible and easy to use. This decision falls strictly on the wrong side of the line of acceptable compromises. > there were technical reasons why iframes didn’t work, though I forget the details It could be that there is one or a couple of engineers at Keybase who made this decision and are also the same entity that replied to the bug bounty. It feels like they haven't thought it through properly or brought it up for proper discussion inside the organization. Let's hope that they remedy this and adjust their general approach to this if this gets enough attention. On the other hand, even if this is addresses, unfortunately it's an indicator that other compromises in this category are done in other parts of Keybase.

Leace 8y ago
When they started asking me for my private key and claiming it'll be secure because it's "encrypted" that raised a red flag for me. Then I found out that they're not using popular and audited libraries like OpenPGPjs instead... writing their own!
- oedmarap 8y ago
  I second this. Would I upload/integrate my public key? Certainly, if it was supported as such. That being said, KB functions just fine without an explicit PGP private key, since each device I install KB on generates its own signing key -- that's good enough for KB to verify my social idents and support initial communication; the more proofs they add the better. But more serious and nested "secure" communication would be wiser done elsewhere.
  - tialaramex 8y ago
    > Would I upload/integrate my public key? I presume this is a typo, but if so it's a grave one. The naming is very transparent, the intent is that we can give everybody our public keys, they're public, while our private key must remain secret. (I like to use the U2 Lyric "A secret is something you tell one other person, so I'm telling you" to keep straight the difference between secret keys, which we must share with somebody else, and private keys, which we shouldn't share with anybody, although DH means in practice you may never need to explicitly "tell" anyone the secret keys in hybrid systems) [Edited because I made the same dumb typo]
- FabHK 8y ago
  Filippo Valsorda had a blog post on uploading his private key (back in 2014) in which he actually publicly uploaded his private key - encrypted, that is, as it is uploaded to Keybase [1]. Of course, it goes against orthodoxy to share/upload your private key, but I'm not sure I've ever seen a good rebuttal to Filippo's post. It seems to me though that you're reducing the entropy of your key from the 2048 bits or whatever to the entropy of your key phrase, which would normally only be some 100 or so bits (if you have a decent one) - but I'm not informed enough to judge the details. However, it seems to me that Filippo is, and he did upload his private key (encrypted) - so how bad is that, really? Anyone got some substantiated insights there? [1] https://blog.filippo.io/on-keybase-dot-io-and-encrypted-private-key-sharing/ https://blog.filippo.io/on-keybase-dot-io-and-encrypted-priv...
  - jwilk 8y ago
    Security strength of RSA is much lower than the key size. 2048-bit RSA gives you only ~112 bits of security.
    - FabHK 8y ago
      That's very informative, thanks. So indeed, with a good passphrase the drop in security is minimal.
  - danenania 8y ago
    If you encrypt a private key with a secret passphrase, then upload the encrypted private key somewhere, the passphrase is essentially your new private key. As long as the passphrase has sufficient entropy, there's no meaningful drop in security with this approach.
  - Leace 8y ago
    I wouldn't have an issue with that if it was a private subkey. You could easily revoke it and replace it in case Keybase does something weird. But giving them private keys for master/primary key is not exactly sensible. For the record I don't have a private master key in any online connected devices. GnuPG works well in an air-gapped scenarios. Does Keybase client? Or does it require constant phoning home?
lrvick 8y ago
Honest question: what makes you think they have -ever- done crypto right? As best I can tell they have rolled their own mostly closed source crypto solution from day 1.
- Shank 8y ago
  TripleSec is open source and they’re basically doing a reference implementation from Applied Cryptography. You can see the details here: https://keybase.io/triplesec https://keybase.io/triplesec
  - lrvick 8y ago
    This is a perfect example of them doing it wrong. Modern cryptographic algorithims rarely get broken, but keys get stolen by malware all the time. Instead of moving the keys out of system memory and thus out of reach of malware they just add layers of obfuscation to a key that is going to be decrypted into system memory. Mixing unrelated strong ciphers is likely to yeild nothing but a false sense of security at best and yeild malleability attacks at worst. If you take your key and encrypt it 3 times, or 200 times, it is still moot if it by design it ends up plaintext in system memory. You don't see anyone else doing this sort of nonsense mix and match security for a reason. Their threat profile is fundimentally broken if they think attacks on modern crypto primitives are more likely than malware on an end users system.

Leace 8y ago

When they started asking me for my private key and claiming it'll be secure because it's "encrypted" that raised a red flag for me. Then I found out that they're not using popular and audited libraries like OpenPGPjs instead... writing their own!

oedmarap 8y ago
I second this. Would I upload/integrate my public key? Certainly, if it was supported as such. That being said, KB functions just fine without an explicit PGP private key, since each device I install KB on generates its own signing key -- that's good enough for KB to verify my social idents and support initial communication; the more proofs they add the better. But more serious and nested "secure" communication would be wiser done elsewhere.
- tialaramex 8y ago
  > Would I upload/integrate my public key? I presume this is a typo, but if so it's a grave one. The naming is very transparent, the intent is that we can give everybody our public keys, they're public, while our private key must remain secret. (I like to use the U2 Lyric "A secret is something you tell one other person, so I'm telling you" to keep straight the difference between secret keys, which we must share with somebody else, and private keys, which we shouldn't share with anybody, although DH means in practice you may never need to explicitly "tell" anyone the secret keys in hybrid systems) [Edited because I made the same dumb typo]
FabHK 8y ago
Filippo Valsorda had a blog post on uploading his private key (back in 2014) in which he actually publicly uploaded his private key - encrypted, that is, as it is uploaded to Keybase [1]. Of course, it goes against orthodoxy to share/upload your private key, but I'm not sure I've ever seen a good rebuttal to Filippo's post. It seems to me though that you're reducing the entropy of your key from the 2048 bits or whatever to the entropy of your key phrase, which would normally only be some 100 or so bits (if you have a decent one) - but I'm not informed enough to judge the details. However, it seems to me that Filippo is, and he did upload his private key (encrypted) - so how bad is that, really? Anyone got some substantiated insights there? [1] https://blog.filippo.io/on-keybase-dot-io-and-encrypted-private-key-sharing/ https://blog.filippo.io/on-keybase-dot-io-and-encrypted-priv...
- jwilk 8y ago
  Security strength of RSA is much lower than the key size. 2048-bit RSA gives you only ~112 bits of security.
  - FabHK 8y ago
    That's very informative, thanks. So indeed, with a good passphrase the drop in security is minimal.
- danenania 8y ago
  If you encrypt a private key with a secret passphrase, then upload the encrypted private key somewhere, the passphrase is essentially your new private key. As long as the passphrase has sufficient entropy, there's no meaningful drop in security with this approach.
- Leace 8y ago
  I wouldn't have an issue with that if it was a private subkey. You could easily revoke it and replace it in case Keybase does something weird. But giving them private keys for master/primary key is not exactly sensible. For the record I don't have a private master key in any online connected devices. GnuPG works well in an air-gapped scenarios. Does Keybase client? Or does it require constant phoning home?

lrvick 8y ago

Honest question: what makes you think they have -ever- done crypto right? As best I can tell they have rolled their own mostly closed source crypto solution from day 1.

Shank 8y ago
TripleSec is open source and they’re basically doing a reference implementation from Applied Cryptography. You can see the details here: https://keybase.io/triplesec https://keybase.io/triplesec
- lrvick 8y ago
  This is a perfect example of them doing it wrong. Modern cryptographic algorithims rarely get broken, but keys get stolen by malware all the time. Instead of moving the keys out of system memory and thus out of reach of malware they just add layers of obfuscation to a key that is going to be decrypted into system memory. Mixing unrelated strong ciphers is likely to yeild nothing but a false sense of security at best and yeild malleability attacks at worst. If you take your key and encrypt it 3 times, or 200 times, it is still moot if it by design it ends up plaintext in system memory. You don't see anyone else doing this sort of nonsense mix and match security for a reason. Their threat profile is fundimentally broken if they think attacks on modern crypto primitives are more likely than malware on an end users system.