6 ms·

Client-side encryption really decreases the attack surfaces of cloud storage solutions. It’s really sad that Keybase failed at building a business around this.

Client-side encryption really decreases the attack surfaces of cloud storage solutions. It’s really sad that Keybase failed at building a business around this. Hopefully someone else is going to make another attempt.

ianopolous 6y ago
We're making an attempt with Peergos.
- capableweb 6y ago
  Not sure how Peergos is a relevant alternative to Keybase? Maybe you're just thinking of the file sharing aspect of Keybase? Keybase as it's core was that it's a key directory that's publicly auditable. Everyone could verify the chain of verification of each other in Keybase. On top of that infrastructure, files and chat was added. Peergos doesn't seem to show any chains or in fact auditable information at all. You can add/remove friends that is supposedly cryptographically verified, but there is no information about it, nor is there any information about where the data is actually stored, how you can get it to your local machine, how to re-verify the claims, how to add devices that have access.
  - ianopolous 6y ago
    There is a public append-only merkle-tree with all identities published in it in an analogous way to certificate transparency. When you add a friend you are looking them up in this tree and then storing their public key chain in your own (private) storage in a tofu manner (then any key changes they make are verified against your local copy). You can also verify keys in person using the same protocol as Signal (via QR codes or number groups). There are no private keys stored on any devices, so adding devices is not a thing. It is a pure capability based system. Unlike keybase, we are fully open source and self-hostable. There are a lot more details in our booklet- https://book.peergos.org https://book.peergos.org
Triv888 6y ago
> Client-side encryption really decreases the attack surfaces of cloud storage solutions. They should rename end-to-end encryption to client-side encryption or something else because it is not very clear what it means
- cipherboy 6y ago
  Not all client-side encryption schemes are end-to-end or at-rest encryption schemes though. Trivial counter example: TLS.
shawnz 6y ago
It wouldn't have prevented this issue though.
- konschubert 6y ago
  Oh, right...true.
theamk 6y ago
If the client-side encryption is in the browser, it would not help: this hijacks channel between two different parts of application, not the cloud storage connection. Having native, non-web app would help here, but I don't think this is ever going to happen.
CPAhem 6y ago
No one cares more about your data than you do. Syncdocs https://syncdocs.com https://syncdocs.com also does end-to-end encryption of Google Docs. The problem is that encryption adds an extra layer of complexity.

ianopolous 6y ago

We're making an attempt with Peergos.

capableweb 6y ago
Not sure how Peergos is a relevant alternative to Keybase? Maybe you're just thinking of the file sharing aspect of Keybase? Keybase as it's core was that it's a key directory that's publicly auditable. Everyone could verify the chain of verification of each other in Keybase. On top of that infrastructure, files and chat was added. Peergos doesn't seem to show any chains or in fact auditable information at all. You can add/remove friends that is supposedly cryptographically verified, but there is no information about it, nor is there any information about where the data is actually stored, how you can get it to your local machine, how to re-verify the claims, how to add devices that have access.
- ianopolous 6y ago
  There is a public append-only merkle-tree with all identities published in it in an analogous way to certificate transparency. When you add a friend you are looking them up in this tree and then storing their public key chain in your own (private) storage in a tofu manner (then any key changes they make are verified against your local copy). You can also verify keys in person using the same protocol as Signal (via QR codes or number groups). There are no private keys stored on any devices, so adding devices is not a thing. It is a pure capability based system. Unlike keybase, we are fully open source and self-hostable. There are a lot more details in our booklet- https://book.peergos.org https://book.peergos.org

Triv888 6y ago

> Client-side encryption really decreases the attack surfaces of cloud storage solutions. They should rename end-to-end encryption to client-side encryption or something else because it is not very clear what it means

cipherboy 6y ago
Not all client-side encryption schemes are end-to-end or at-rest encryption schemes though. Trivial counter example: TLS.

shawnz 6y ago

It wouldn't have prevented this issue though.

konschubert 6y ago
Oh, right...true.

theamk 6y ago

If the client-side encryption is in the browser, it would not help: this hijacks channel between two different parts of application, not the cloud storage connection. Having native, non-web app would help here, but I don't think this is ever going to happen.

CPAhem 6y ago

No one cares more about your data than you do. Syncdocs https://syncdocs.com https://syncdocs.com also does end-to-end encryption of Google Docs. The problem is that encryption adds an extra layer of complexity.