5 ms·

Keybase was dead as soon as they took VC money. Their original purpose — tying identities to keys — could have been a nice small non-profit. But there aren't f

by pornel 7y ago

Keybase was dead as soon as they took VC money. Their original purpose — tying identities to keys — could have been a nice small non-profit. But there aren't fortunes to be made from managing GPG keys, so they had to pivot into shark jumping.

zelly 7y ago
https://pgp.mit.edu/ https://pgp.mit.edu/
- chizhik-pyzhik 7y ago
  keyservers don't work as a root of trust. look at all the 'satoshi nakamoto' keys supposedly from 2004 https://pgp.mit.edu/pks/lookup?search=Satoshi+Nakamoto&op=index https://pgp.mit.edu/pks/lookup?search=Satoshi+Nakamoto&op=in...
- dijit 7y ago
  That doesn't tie identity to keys. Not to mention it's notoriously slow and has been shown to be an insecure method of distributing keys (due to the fact that anybody can upload any key).
  - zelly 7y ago
    Anyone can upload a key to keybase dot com too. You should never trust a key belongs to someone unless you have verified the fingerprint by other means e.g. speaking to them. This is basic security we have known since the 80s. Keybase dot com is a step backwards if anything because of the false sense of security it creates, as if they don't have a giant attack surface.
    - dewey 7y ago
      You don't understand what Keybase does. The whole point is that you don't just use it to upload a key. You link various verified identifies of yours across the web to your Keybase account so people know the PGP key there is the one of the verified person. It's a way to tie all your verified identifies together. If someone would manage to compromise a bunch of identities of someone on the internet, and then create a Keybase account with them and then upload a compromised PGP key that would be a problem if you don't verify the key. But that's a bit of a stretch.
      - efreak 7y ago
        In reality: I used keybase for a while. When I allowed a domain to expire and the DNS record disappeared, keybase threw up warning both in cli and their website that my identity verification couldn't be completed. My only problems I ever had with keybase was related to the cloud storage they offer. My real wish is that keybase supported ssh keys and would provide them as an agent.
        namibj 7y ago
        You can revoke the DNS signature. I'll assume your keybase account name is the same as on HN. I do agree on the ssh key feature being nice, and, here's a link: https://keybase.io/blog/keybase-ssh-ca https://keybase.io/blog/keybase-ssh-ca You could also just use the keybase file system to keep ssh keys around.
- fossuser 7y ago
  Linking to this is evidence that you don't understand the entire value of Keybase. PGP sucks.
  - zelly 7y ago
    Why? PGP works. (That alone puts it above its supposed alternatives.) It has existed for 30 yrs. That's 30 years of being exploited and patched. PGP (GnuPG at least) is lightweight. I don't need an Electron dependency or a multi-megabyte chat room in the same application (address space too?) that supposedly keeps my private keys safe. PGP is spoken by everyone, every programming language, having implementations on even ancient operating systems and architectures. Every email client worth its salt can use PGP. Emacs can decrypt and encrypt GnuPG-encrypted files seamlessly; other editors have plugins to do the same.
    - fossuser 7y ago
      It sucks because the UX is so bad that people don’t use it, even when their lives depend on it. [0] Even when they do use it, it’s easy to mess up. The biggest flaw though is that in person key signing parties were never a viable or realistic thing for identity verification and web of trust based on that works poorly as a result. The use of multiple signed public social media accounts for identity instead as a way to fix this was Keybase’s main innovation. For UX, even Snowden couldn’t get Greenwald to set up PGP and after multiple attempts Snowden eventually gave up and tried Laura Poitras with better results, the burden on the user is too high. [0] https://moxie.org/blog/gpg-and-me/ https://moxie.org/blog/gpg-and-me/
- ccktlmazeltov 7y ago
  this doesn't even have authenticated encryption
- m4lvin 7y ago
  Please, please, use https://keys.openpgp.org/ https://keys.openpgp.org/ instead! See https://keys.openpgp.org/about https://keys.openpgp.org/about for why.
hosh 7y ago
We have letsencrypt and permanent.org as non-profits. An idea of a identity and key non-profit sounds like another critical piece we would need for a free, open web
- hinkley 7y ago
  Is this functionality something that would make sense for LetsEncrypt to implement?
  - throwaway888abc 7y ago
    They have already massive infra in place. And are non-profit. Sort of 'natural' expansion. I would love to see it.
    - gus_massa 7y ago
      The problem with natural expansion is that it degenerates into feature creep. Is it natural to add a cryptocoin wallet later like Keybase did?
      - hinkley 7y ago
        The advantage of following is that you get to cherry-pick what features actually got traction and skip over a lot of rat holes.
- chacha2 7y ago
  Seems a bit early to call 'permanent.org' a critical piece, even if it succeeds all it's doing is cloud storage.
  - hosh 7y ago
    That's fair. We'll see how well they execute their vision. However, after playing with it, checking out their board of directors, and deconstructing their app design, their vision is not really "cloud storage", at least, not the way we typically think of it. Their long-term mission is preserving a digital legacy, oriented around relationships, families, and organizations. You don't use permanent.org to store things in the cloud that people normally think as "cloud storage", not for the day-to-day stuff. The kind of things you want to store in there are the things you want the world and your descendents to have access to after you die. They won't have to (directly) pay upkeep to keep that legacy preserved. I think that is convincing enough for me to see it as a critical piece of free and open web, even if this doesn't seem obviously connected to the idea of preserving a legacy. For example, an indie musician wouldn't have to rely on SoundCloud to keep their recorded music around. SoundCloud is not in the business of preserving the creative work; they are in the business of aggregating users and they use user content to do it. Placing those music files in permanent.org has a much better shot of preserving that creative legacy for future generations than leaving it on SoundCloud.

by pornel 7y ago

zelly 7y ago

https://pgp.mit.edu/ https://pgp.mit.edu/

chizhik-pyzhik 7y ago
keyservers don't work as a root of trust. look at all the 'satoshi nakamoto' keys supposedly from 2004 https://pgp.mit.edu/pks/lookup?search=Satoshi+Nakamoto&op=index https://pgp.mit.edu/pks/lookup?search=Satoshi+Nakamoto&op=in...
dijit 7y ago
That doesn't tie identity to keys. Not to mention it's notoriously slow and has been shown to be an insecure method of distributing keys (due to the fact that anybody can upload any key).
- zelly 7y ago
  Anyone can upload a key to keybase dot com too. You should never trust a key belongs to someone unless you have verified the fingerprint by other means e.g. speaking to them. This is basic security we have known since the 80s. Keybase dot com is a step backwards if anything because of the false sense of security it creates, as if they don't have a giant attack surface.
  - dewey 7y ago
    You don't understand what Keybase does. The whole point is that you don't just use it to upload a key. You link various verified identifies of yours across the web to your Keybase account so people know the PGP key there is the one of the verified person. It's a way to tie all your verified identifies together. If someone would manage to compromise a bunch of identities of someone on the internet, and then create a Keybase account with them and then upload a compromised PGP key that would be a problem if you don't verify the key. But that's a bit of a stretch.
    - efreak 7y ago
      In reality: I used keybase for a while. When I allowed a domain to expire and the DNS record disappeared, keybase threw up warning both in cli and their website that my identity verification couldn't be completed. My only problems I ever had with keybase was related to the cloud storage they offer. My real wish is that keybase supported ssh keys and would provide them as an agent.
      - namibj 7y ago
        You can revoke the DNS signature. I'll assume your keybase account name is the same as on HN. I do agree on the ssh key feature being nice, and, here's a link: https://keybase.io/blog/keybase-ssh-ca https://keybase.io/blog/keybase-ssh-ca You could also just use the keybase file system to keep ssh keys around.
fossuser 7y ago
Linking to this is evidence that you don't understand the entire value of Keybase. PGP sucks.
- zelly 7y ago
  Why? PGP works. (That alone puts it above its supposed alternatives.) It has existed for 30 yrs. That's 30 years of being exploited and patched. PGP (GnuPG at least) is lightweight. I don't need an Electron dependency or a multi-megabyte chat room in the same application (address space too?) that supposedly keeps my private keys safe. PGP is spoken by everyone, every programming language, having implementations on even ancient operating systems and architectures. Every email client worth its salt can use PGP. Emacs can decrypt and encrypt GnuPG-encrypted files seamlessly; other editors have plugins to do the same.
  - fossuser 7y ago
    It sucks because the UX is so bad that people don’t use it, even when their lives depend on it. [0] Even when they do use it, it’s easy to mess up. The biggest flaw though is that in person key signing parties were never a viable or realistic thing for identity verification and web of trust based on that works poorly as a result. The use of multiple signed public social media accounts for identity instead as a way to fix this was Keybase’s main innovation. For UX, even Snowden couldn’t get Greenwald to set up PGP and after multiple attempts Snowden eventually gave up and tried Laura Poitras with better results, the burden on the user is too high. [0] https://moxie.org/blog/gpg-and-me/ https://moxie.org/blog/gpg-and-me/
ccktlmazeltov 7y ago
this doesn't even have authenticated encryption
m4lvin 7y ago
Please, please, use https://keys.openpgp.org/ https://keys.openpgp.org/ instead! See https://keys.openpgp.org/about https://keys.openpgp.org/about for why.

hosh 7y ago

We have letsencrypt and permanent.org as non-profits. An idea of a identity and key non-profit sounds like another critical piece we would need for a free, open web

hinkley 7y ago
Is this functionality something that would make sense for LetsEncrypt to implement?
- throwaway888abc 7y ago
  They have already massive infra in place. And are non-profit. Sort of 'natural' expansion. I would love to see it.
  - gus_massa 7y ago
    The problem with natural expansion is that it degenerates into feature creep. Is it natural to add a cryptocoin wallet later like Keybase did?
    - hinkley 7y ago
      The advantage of following is that you get to cherry-pick what features actually got traction and skip over a lot of rat holes.
chacha2 7y ago
Seems a bit early to call 'permanent.org' a critical piece, even if it succeeds all it's doing is cloud storage.
- hosh 7y ago
  That's fair. We'll see how well they execute their vision. However, after playing with it, checking out their board of directors, and deconstructing their app design, their vision is not really "cloud storage", at least, not the way we typically think of it. Their long-term mission is preserving a digital legacy, oriented around relationships, families, and organizations. You don't use permanent.org to store things in the cloud that people normally think as "cloud storage", not for the day-to-day stuff. The kind of things you want to store in there are the things you want the world and your descendents to have access to after you die. They won't have to (directly) pay upkeep to keep that legacy preserved. I think that is convincing enough for me to see it as a critical piece of free and open web, even if this doesn't seem obviously connected to the idea of preserving a legacy. For example, an indie musician wouldn't have to rely on SoundCloud to keep their recorded music around. SoundCloud is not in the business of preserving the creative work; they are in the business of aggregating users and they use user content to do it. Placing those music files in permanent.org has a much better shot of preserving that creative legacy for future generations than leaving it on SoundCloud.