7 ms·

Zoom bought keybase a while back. Now it's time to use their identity verification features.

by wbeckler 5y ago

lucgommans 5y ago
Note that Keybase never offered end-to-end encryption, they tried to solve it with blockchain magic and, granted, got quite far (what they made truly was innovative), but missed a tiny step of actually checking the blockchain (which would be resource-intensive for mobile devices, which is why they pushed it back for later solving) or offering any other way of verifying the encryption keys. I actually reached out to Keybase as well as one of the NCC auditors that I've talked to in the past for unrelated reasons, but the auditors are playing deaf and Keybase (on the third contact attempt) claims it's safe because of the decentralized social proofs (which aren't actually verified by the app -- you trust solely on the Keybase servers to give you the right encryption keys). All details are here: https://security.stackexchange.com/questions/222055/how-can-i-verify-keybases-end-to-end-encryption-between-me-and-a-friend https://security.stackexchange.com/questions/222055/how-can-... The whole thing seems moot now that Zoom bought them, but so now if Zoom does anything with blockchain and supposed end-to-end encryption, I'd be very weary and verify things regardless of whether it was audited. Even as a user, you can make sure they covered the basics (from my StackExchange post linked above): > Users should have demanded followable instructions. We should have questioned Keybase, now Zoom, and anyone who makes a strong security claim. They claim it? You should want to see steps you can follow to verify it. Since you put your trust in the published code, those instructions should not involve any command line coding work, and definitely not have gaps like verifying keys on your laptop and hoping that the server sent the same keys to your phone.

7 ms·

Zoom bought keybase a while back. Now it's time to use their identity verification features.

by wbeckler 5y ago

Zoom bought keybase a while back. Now it's time to use their identity verification features.

lucgommans 5y ago
Note that Keybase never offered end-to-end encryption, they tried to solve it with blockchain magic and, granted, got quite far (what they made truly was innovative), but missed a tiny step of actually checking the blockchain (which would be resource-intensive for mobile devices, which is why they pushed it back for later solving) or offering any other way of verifying the encryption keys. I actually reached out to Keybase as well as one of the NCC auditors that I've talked to in the past for unrelated reasons, but the auditors are playing deaf and Keybase (on the third contact attempt) claims it's safe because of the decentralized social proofs (which aren't actually verified by the app -- you trust solely on the Keybase servers to give you the right encryption keys). All details are here: https://security.stackexchange.com/questions/222055/how-can-i-verify-keybases-end-to-end-encryption-between-me-and-a-friend https://security.stackexchange.com/questions/222055/how-can-... The whole thing seems moot now that Zoom bought them, but so now if Zoom does anything with blockchain and supposed end-to-end encryption, I'd be very weary and verify things regardless of whether it was audited. Even as a user, you can make sure they covered the basics (from my StackExchange post linked above): > Users should have demanded followable instructions. We should have questioned Keybase, now Zoom, and anyone who makes a strong security claim. They claim it? You should want to see steps you can follow to verify it. Since you put your trust in the published code, those instructions should not involve any command line coding work, and definitely not have gaps like verifying keys on your laptop and hoping that the server sent the same keys to your phone.