3 ms·

2FA is not very helpful if your service relies on encryption for everything (like keybase). It's not possible to use 2FA without another party verifying the aut

by kokx 7y ago

2FA is not very helpful if your service relies on encryption for everything (like keybase). It's not possible to use 2FA without another party verifying the authentication code. Keybase could include this (then they would have to verify it), but so far keybase has gone to great lengths to not actually have to hold any secrets for users. They even perform password hashing in the browser instead of on their servers. 2FA would force them to do some processing with secrets on the server side. Having 2FA with Keybase would be similar to having 2FA with a local password safe like Keepass. Yes, you could implement 2FA. However, you would have to rely on an external service, and if people have your password and can modify the software, they can simply comment out the 2FA check and they can decrypt your password safe. The entire security model of Keybase is based on having all data encrypted at all times. Adding 2FA would add some false sense of security, which doesn't affect the encrypted data at all.

aeternus 7y ago
I disagree, having a single password is a risk even if all encryption is done locally. Why not use an M-of-N / 2-of-3 encryption scheme where the user can optionally have Keybase protect one of those keys via a 2nd factor. The user would keep the 3rd in the form of a yubikey or simply written down and physically secured. This could improve both usability and security and Keybase itself still doesn't have access to your data.
viraptor 7y ago
> It's not possible to use 2FA without another party verifying the authentication code. That's not true. You can verify the time based codes or do u2f yourself. You don't need a third party for that.
- DuskStar 7y ago
  Right, but there's no way to cryptographically enforce that. All the totp implementations I've seen are symmetric, with the validating server running the same calculation from the same seed. You could do that locally - but then the seed can be extracted or a client can be patched to just not request the code in the first place.

by kokx 7y ago

aeternus 7y ago

I disagree, having a single password is a risk even if all encryption is done locally. Why not use an M-of-N / 2-of-3 encryption scheme where the user can optionally have Keybase protect one of those keys via a 2nd factor. The user would keep the 3rd in the form of a yubikey or simply written down and physically secured. This could improve both usability and security and Keybase itself still doesn't have access to your data.

viraptor 7y ago

> It's not possible to use 2FA without another party verifying the authentication code. That's not true. You can verify the time based codes or do u2f yourself. You don't need a third party for that.

DuskStar 7y ago
Right, but there's no way to cryptographically enforce that. All the totp implementations I've seen are symmetric, with the validating server running the same calculation from the same seed. You could do that locally - but then the seed can be extracted or a client can be patched to just not request the code in the first place.