2 ms·

Sad. Very sad. It was such a great approach to associating GnuPG keys with social media. And their chat etc were also pretty cool. But Zoom is beyond the pale.

Sad. Very sad. It was such a great approach to associating GnuPG keys with social media. And their chat etc were also pretty cool. But Zoom is beyond the pale. So what now? Maybe someone could clone the GitHub repos. And/or are GnuPG keyservers safe enough again? For chat, Session looks most interesting. It's got the Signal messaging bits. Plus anonymity via the Loki onion network. And it's available for all platforms. However, it's very new, and often buggy. And the Loki Foundation is Australian. So at some point they'll likely get pressured to backdoor stuff. And they probably won't be able to disclose that, unless someone leaks. There's also Tox, where each user runs a Tor onion client. That's secure enough in Whonix. But the Whonix user base is miniscule, and I wouldn't trust an implementation in Windows. But then, maybe Session in Windows is too iffy as well. Anyway, I'll be deleting my Keybase account, as soon as I've negotiated alternate comms with my contacts.

namibj 6y ago
So, yeah. Zoom did bad stuff. But Keybase is designed so that all those things would obviously be detectable (Keybase client code is open source), and the ways in which the Server could mess with data are much restricted. If that spreads to Zoom, there's a chance it'd be a good service in a year or two. PGP keyservers have a fundamental issue that demands a solution like CT logs or Keybase-style merkle trees. The only way to prevent getting Loki backdoor issues would seem to be a development so clearly in-the-open, that any secretive addition of significant code/suspicious PR behavior is obvious. Tor does not use Tor by default. It works with Tor, but that's it.
- rndgermandude 6y ago
  They are also kinda buying a social graph of mostly IT and security professionals, sprinkled with some journalists (and not the kind that usually does the "10 things" articles) and general tinfoil hats. My tinfoil hat tells me this information could be somewhat valuable to their Chinese overlords...
  - mirimir 6y ago
    Yes, it's Zoom's Chinese connections that rule them out, for me.

namibj 6y ago

So, yeah. Zoom did bad stuff. But Keybase is designed so that all those things would obviously be detectable (Keybase client code is open source), and the ways in which the Server could mess with data are much restricted. If that spreads to Zoom, there's a chance it'd be a good service in a year or two. PGP keyservers have a fundamental issue that demands a solution like CT logs or Keybase-style merkle trees. The only way to prevent getting Loki backdoor issues would seem to be a development so clearly in-the-open, that any secretive addition of significant code/suspicious PR behavior is obvious. Tor does not use Tor by default. It works with Tor, but that's it.

rndgermandude 6y ago
They are also kinda buying a social graph of mostly IT and security professionals, sprinkled with some journalists (and not the kind that usually does the "10 things" articles) and general tinfoil hats. My tinfoil hat tells me this information could be somewhat valuable to their Chinese overlords...
- mirimir 6y ago
  Yes, it's Zoom's Chinese connections that rule them out, for me.