13 ms·

Keybase raises $10.8M

343 points by doppp 11y ago

ok_craig 11y ago
Congrats! Keybase has been making cryptography easier for me and everyone I know.
ejcx 11y ago
Good for them. I've been watching them quietly working hard, and it has been like that for a while now. Good luck! Hopefully some projects that make security completely invisible come about from this.
petesoder 11y ago
"We have a new goal: to bring public key crypto to everyone in the world, even people who don't understand it." Love the vision, guys. Huge congrats! Looking forward to seeing this one unfold.
- mirimir 11y ago
  That is indeed a great vision!
- anfedorov 11y ago
  People who don't understand what public crypto is, or the details of the mathematics behind it?
lisper 11y ago
An open-source, audited, encryption application based on NaCl already exists: https://github.com/Spark-Innovations/SC4 https://github.com/Spark-Innovations/SC4 I also have a keyserver that is currently in closed beta. Contact me if you want an invite.
zmanian 11y ago
One request Keybase friends... Can we get a forum or mailing list to discuss crypto design decisions, security etc on launch day?
fredley 11y ago
Congrats! Increasingly pessimistic as a British subject that I'll ever be able to use something like this without attracting the attention of my own government though.
- zmanian 11y ago
  Maybe you'll be okay in the UK? Still avoiding the UK like the plague right now... http://www.businessinsider.com/uk-government-not-going-to-ban-encryption-2015-7 http://www.businessinsider.com/uk-government-not-going-to-ba...
  - raesene9 11y ago
    Unfortunately the headline for that article doesn't, to me, reflect the letter that's published at the end. They say that they're not targeting encryption directly, but they still say that they essentially want a back door into all communications systems, which is going to necessitate either getting technology providers to give them one, or banning of those that don't. (of course it also won't even come close to achieving their goal, but I somehow don't think that'll stop 'em)
- signal11 11y ago
  RIPA in the UK already allows for mandatory key disclosure if required by law enforcement: https://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom https://en.wikipedia.org/wiki/Key_disclosure_law#United_King... And intelligence agencies have been known to retain encrypted content for longer (in theory, forever): http://www.darkreading.com/risk-management/want-nsa-attention-use-encrypted-communications/d/d-id/1110475 http://www.darkreading.com/risk-management/want-nsa-attentio...? The older I get the more impressed I am with how prescient Scott McNealy was when he said: "You have zero privacy anyway. Get over it."
magicmu 11y ago
This is an amazing pursuit, and I wish you guys the absolute best! Unfortunately, I think public adoption of encryption will continue to be a problem until there is absolutely no barrier -- both in knowledge and UI design -- between the average user and encryption. This is a huge step in the right direction though!
_pius 11y ago
Happy to hear this, love what they're doing.
baby 11y ago
It's pretty awesome how simple it is to use. But why trust a third party to hold your private key? Why trust them to not store the plaintext when you encrypt/decrypt with them?
- chrisfosterelli 11y ago
  You don't have to trust them, you can use their open source downloadable client. The web interface is only for ease of use, and they make it clear that many people consider that "unsafe" compared to their desktop/command line alternative.
  - teacup50 11y ago
    Yet they still offer it as the easy option, despite it being absolutely wrong.
zekevermillion 11y ago
Awesome! I hope some of this $ will help to shorten the waiting list queue...
- coldpie 11y ago
  Throw me an email if you'd like an invite. Edit: I don't have any more!
  - DarkLinkXXXX 11y ago
    ditto
    - zekevermillion 11y ago
      I have now received an invite. Thanks for all the kind offers! Zeke
- deckar01 11y ago
  I just sent an invite to your adlervermillion address. To be honest I haven't found their service to be useful in my day to day life. I am mainly inviting you out of sheer guilt, because I have been accruing invites and not using the service. "Use your keybase account. There are insecure children in the US that write their passwords on post-it notes." ;)
  - jedberg 11y ago
    I've been on it for a couple months now. I've used it twice: once was to exchange AWS IAM keys for a consulting job and the other was for someone to give me their credit card details. But in most cases it's just to track someone.
  - zekevermillion 11y ago
    Thanks, appreciate it.
- kstrauser 11y ago
chrisfosterelli 11y ago
> The Node reference client to our PGP directory will be retired. (PGP support will continue, of course.) Can anyone from Keybase shed light on the reasoning behind this? It sounds like you are moving away from programmer-friendly API libraries and into GUI apps. Even if they're open source, as a developer I really liked your up-front API. Will you still be providing those APIs?
- malgorithms 11y ago
  Oh, a clarification: the Node client will be replaced by the Go version. The `keybase` command line app will be a superset of what's available in the Node client now. Sorry. So yeah - still providing those API's. PGP support will continue, always, it's just that you won't need to have PGP on all your devices -- just the ones you use PGP on. Your PGP key will be part of a family of keys you're known by. If you install Keybase and have no idea what PGP is we don't make you get a PGP key. By switching to device-specific keys via apps on every platform, we can solve security and convenience problem at the same time. As the blog post says, this can only work if you can bring pairs of devices together. Which has only been possible and convenient the last couple years.
  - chrisfosterelli 11y ago
    Ah, ok. Go binaries tend to be more portable and don't require npm, so I can understand that direction. Thanks for the explanation!
  - jamra 11y ago
    It's about time for your obligatory /r/golang post about how you switched from 30 servers to 1 by switching to Go ;)
    - davidbanham 11y ago
      It's client-side code they're migrating rather than server-side. Fingers crossed it makes the CLI a bit snappier!
  - 11y ago
davesque 11y ago
Very timely, considering the possible resurgence of the crypto wars.
bascule 11y ago
Hopefully they'll be able to address this then: http://i.imgur.com/3VAMerv.png http://i.imgur.com/3VAMerv.png (from https://twofactorauth.org/ https://twofactorauth.org/)
- malgorithms 11y ago
  Yes, addressed soon. The ideal answer for 2FA in a key-per-device app isn't really the same as the normal site + Google Authenticator / Authy kind of thing.
Redoubts 11y ago
https://keybase.io/jobs https://keybase.io/jobs is timing out (504). =)
hippich 11y ago
From my limited following keybase.io it seems like this is mostly hobby project. How does one get investment for this kind of projects? Do you need to know someone already? Or do you decide to pull a plunge and create business plan and present it on one of these demo days organized for investors? I feel like there is a huge gap between potent, but still hobby, project and series A funding.
- jsprogrammer 11y ago
  U jelly? I imagine you walk up to Marc and say, "Hey, we are building PGP for the world." Some days later, $10,000,000 pops in to your bank account. Edit: Would be considerate if the down-modders would provide an alternate scenario.
  - rosser 11y ago
    Edit: Would be considerate if the down-modders would provide an alternate scenario. I'd imagine you're being downvoted more for the "U jelly?" childishness than the (im)plausibility of your (completely out of touch with reality) notion of how Keybase got their funding. That's why I downvoted, anyway; I saw your opening line, clicked the down arrow, and moved on to the next comment without further thought or consideration. Whether you agree with the mod-supported position that downvotes can legitimately be used as a form of disagreement or not, they're explicitly also meant to be used to discourage the kind of discourse that brings down the tone of the site. "U jelly?" certainly qualifies as that.
    - jsprogrammer 11y ago
      Thanks for your opinion. >"U jelly?" certainly qualifies as that. I'd argue that maligning keybase as a hobby project qualifies as much as "U jelly?". At least it is discourse, rather than an anonymous downmod.
      - rosser 11y ago
        It's a matter of tone. Whether you disagree with the Ur-parent's position that Keybase is — or, more accurately, "feels like" — a "hobby" project, the position was presented first as an individual's perspective, and second, was asking for clarification. He (?) wasn't saying, "Keybase is just a hobby project," but rather, "Keybase feels to me like a hobby project. How does something that seems like a hobby project get $10MM in funding?" Your response was low-brow dismissal, and not of the poster's position (you didn't respond to what they said), but of the poster (again, you talked about the poster, not what they said). Do you see the difference?
rnhmjoj 11y ago
Hacker news managed to kill even keybase.io.
pjlegato 11y ago
The fatal problem with this plan is that all end user devices are by now hopelessly compromised. Take a look at the Snowden documents, which are now years behind the state of the art. It doesn't matter if your crypto is both bulletproof and easy to use. They'll just break into your phone or your laptop through a side channel and read the key. And you won't even notice.
- deleted 11y ago
  [deleted]
- cpach 11y ago
  Have it ocurred to you that different people have different threat models? Yes, if a powerful state actor really is after you, they will most probably find a way sooner or later. Crypto is still useful for lots of use cases. E.g. protecting data from competitors, stalkers or identity thiefs.
  - pjlegato 11y ago
    This sort of thing may have been limited to powerful state actors a few years ago, but now Pandora's Box has been opened. Many other actors are now actively exploiting the holes deliberately created in the entire stack of computer security infrastructure over the past 20 years by those state actors. It's far more likely that you'll run into someone trying to steal your credit card than an intelligence agency, but they'll be using the same exploit to get into your phone.
    - cpach 11y ago
      So the only resort then I guess is to abandon computers and only use cash and pen and paper.
      - kajecounterhack 11y ago
        Nobody's saying that. I think what's being said here is just that we need to fix what's broken. Acknowledging that your physical devices have side channels is important.
jamra 11y ago
I once thought of doing the same for medical information. I am really excited and eager to see you succeed. It's a shame that America does not offer some kind of national repository, but at the same time, it's great that you can tie a user's own data to his consent. It all works great for non emergency situations. Good job getting the money. I hope you can get the work done too.
tunafishman 11y ago
Really well written. Kudos to whoever wrote your copy!
realusername 11y ago
I have a small question here for the people who use keybase and it's been difficult to find answers for this. How do you encrypt per email address ? is that even possible ? I would like to use it for a personal project of mine and that would be the use case. (Sorry to hijack this thread, it might be interesting for other people). Congratulation to the whole team for your hard work !
- coldpie 11y ago
  I don't know what you mean by "encrypt per email address." Who is doing the encrypting, and to who? Do you want to have multiple keypairs associated with a single keybase account?
  - realusername 11y ago
    You can encrypt with lots of things, for example $> keybase encrypt twitter://twitter_id -m 'message' But there seems to be no way to to it with an email address like this: $> keybase encrypt email://email@example.org -m 'message' Or maybe I did not understand something.
    - coldpie 11y ago
      Yeah, email's a bit more complicated than twitter. I think for the time being, you want to just encrypt to a file and attach that. Maybe there's a standard (PGP mail?) that keybase could output to a file, but that doesn't tend to play well with the GUI mail clients that people typically use.
      - realusername 11y ago
        Thanks for your answer. The main goal on my case is to use the email address as an identity (since it's currently the closest thing I have for this) and not to send encrypted PGP email messages. That's why I never really understood keybase. You can encrypt with a twitter id but not send a encrypted tweet with GPG anyway, so why can't you encrypt by email ? I assumed the most basic form of identity is an email address. Thanks again for your answer.
higherpurpose 11y ago
I wish we didn't push outdated crypto protocols such as PGP. So many companies seem to want to invest money or development time into making PGP "better" - with one exception: they can't make it forward secure, which I think is absolutely critical in today's world of companies and individuals "losing everything" in a hack. Investing in a protocol that will last another 20 years and doesn't even have forward secrecy seems like such a wasted opportunity. It feels like one of those things where 20 years later you think "I wish we hadn't done that then".
irq-1 11y ago
Keybase is the wrong way to do a PKI directory. First, people should have multiple keys/identities by default; multiple identities should be the normal thing everyone does. Single identities will be used by governments to control people. They'll also work against normal communication patterns where people speak differently to different groups (think parents, friends, coworkers.) Second, matching a name with social media is the wrong way to lookup others. It only works if people put enough personally identifiable information (PII) on their social media accounts, otherwise we won't be sure we found the right person. This matching system encourages PII, works against multiple identities, and associates multiple accounts on disparate systems. Everything you told Facebook, you've now told Reddit and Github, etc.. because the companies can also lookup your (single) Keybase identity and connect the accounts, as can advertisers and governments. Third, leaving people to manage their own private keys is worse for security than having them managed by others. Software changes, glitches and upgrades should be overseen server-side and managed; there should be a help-desk to contact and backups should actually be done, etc... Multiple identities would make it easy to let an employer manage an 'employee' identity, and Facebook manage -or consume- a public 'personal' identity, and Twitter manage a private 'political' identity. (A PKI version of OAuth and 'Sign in with Facebook'; strong crypto can't fix the UX problem.) I think the winning solution will be: a distributed, server-side PKI system that individuals and companies can host themselves; a DNS-like distributed registration and searching system; a host-provided web UX for managing accounts. Moving private keys to the client will work better if the local key is signed by a hosted key, rather than leaving all the private keys in the hands of end-users.
- hellbanner 11y ago
  Great response. Do you think there's a way to monetize this proposed solution?
- nailer 11y ago
  > Second, matching a name with social media is the wrong way to lookup others. Assuming it /is/: a well known social media site called Facebook already has a space for GPG keys. That doesn't mean keybase can't succeed and I do wish them luck though. First step: buy keybase.com, because people who don't know what encryption is don't understand .io domain names.
chinathrow 11y ago
Why the invite thing? Really? Why shorten artificially on who you let in?
- jamwt 11y ago
  Referral trees let you control abuse; if someone suddenly spawns lots of accounts via nested referrals for abuse, you can just cleave off the appropriate subtree.
  - chinathrow 11y ago
    Really? How can they publicly state that they promote security and open source tools while denying anyone access who like to use the service?
    - VLM 11y ago
      You're not really using the service, you're connecting to "the" web of trust (Are there disconnected non-contiguous islands on keybase? Only the admins know, probably). That makes me feel "meh" about giving out my invites to random HN users. I mean, if you're not going to connect to me, or the rest of the WoT, then what value do "we" get from you joining, and if you're not going to connect to me, or the rest of the WoT, then what value do you get from my invite? Now what I don't understand is there are existing large WoT in GPG keys and they "shoulda" given like 1000 invites to anyone with a debian.org developer key because thats a community of deeply connected very long term WoT (well, more or less). Find someone in your existing WoT who is on keybase and they probably have invites and will give one. I have invites. I will give them out to anyone in my existing WoT who asks. If they aren't in my WoT then theres no point for them to ask, or me to give. Even friend of friend or more distant, not just signed each others keys. This also creates a dilemma where I have to keep a stockpile of invites in case some I closely connect to "needs" an invite. So FoFoFoF of some guy I met at a HOPE conf might not get one of my invites because I need to save it in case my coworker finally gets off his butt and signs up and he needs my invite. This is rollout mistake two, I should be able to request via a form or something "I have a really good excuse now gimme an invite". However they're AFAIK randomly granted over time or something.
keybase-please 11y ago
Can someone please send a Keybase invitation to: keybase-please@Safe-mail.net This help would be appreciated.
- ddworken 11y ago
  Just sent you an invite. If anyone else needs an invitation, I still have 8 left. Shoot me an email or reply here if you want one. Edit: 6 still left.
  - tanderson92 11y ago
    Please? tanderson@exherbo.org
  - keybase-please 11y ago
    Thank you!
  - ddworken 11y ago
    I'm all out, sorry everyone.
  - befwi 11y ago
    Please ? befwi@live.fr. Thanks
jtwebman 11y ago
Congrats guys! I had played around with this 6 months ago. Looking forward to seeing what you guys build.
snissn 11y ago
Do they have any sort of monetization plan or strategy?
- OJFord 11y ago
  Yes, see the blog post ..?
  - snissn 11y ago
    Ah, thanks I didn't make it that far
chinathrow 11y ago
I just looked at the source of the page: A) external CSS which might leak about a visitor to Google B)  No 3rd party JS: good. Still leaking visitor info: bad.
- malgorithms 11y ago
  hah, I forgot about that note. Good point - our stance was to protect from targeted code injections (by a coerced or hacked Google). But of course you're right, there's no point letting Google know at all. I've made an issue to move font/css hosting off Google.
  - chinathrow 11y ago
    Thank you very much - great reaction.
  - brandon 11y ago
    You might also consider setting Content-Security-Policy headers to enforce your intent. http://content-security-policy.com/ http://content-security-policy.com/
taf2 11y ago
Grats @gabrielh!
stuartaxelowen 11y ago
It feels like their growth strategy is "make security decisions for other people".
jgalt212 11y ago
> Chris Dixon championed the deal; he’s known for his visionary investments, ranging from Soylent to Oculus to Airware. Pretty strong language there (and definitely not provably true or fale), but I guess bold phrasing is what SV is known for.
foote 11y ago
The Terms and Conditions for Keybase.io seem lopsided (https://keybase.io/docs/terms https://keybase.io/docs/terms). Why is that?
reviseddamage 11y ago
>server-side PKI system that individuals and companies can host themselves It is not possible to deploy this to the mainstream who probably need encryption the most. Keybase's mission iirc is to bring encryption to the masses without having to learn about encryption. It is imo the best alternative to the status quo, i.e: no encryption.
xanderjanz 11y ago
Doesn't this just set up a central failure point? Does Keybase have a forward secure key system?
whodges 11y ago
Wonder just how secure the @keybase.io email part of this is going to work? Would you have to load this email into a client or would you just pull down the email in Node? Thoughts anyone?
ahuja_s 11y ago
This could help solve the personal identity verification issues associated with smart contracts and such. This is one of the key problems with the Ethereum project too.
lelininkas 11y ago
"Your mom is on LinkedIn and Facebook, downloading toolbars." I laughed too hard at this. To be honest I still am.
OrangeTux 11y ago
I've still some invites left, who want one?
- coderunner 11y ago
  Hi, I'd be interested in one if you still have any left. My email is captainlinger2000@gmail.com if that's what you need to send an invite.
  - OrangeTux 11y ago
    Done -----BEGIN PGP MESSAGE----- Version: GnuPG v1.4.12 (GNU/Linux) owEBOgLF/ZANAwACAert2DDXuRFrAcsKYgBVp03FRG9uZYkCHAQAAQIABgUCVadN xQAKCRDq7dgw17kRa6MIEACX5rLZo7t+Wt+0NYBaIQd3JPY0A/5TxPec8bKa2k6/ Mj1Gg9Dl+UJ0GB9WXraYiWz65BhwjsyyI0ZCtisRJ/pprr7adMi5uRs0W6HgydEh ixm9FEqHsH4jjwr2gmfb8Xs2+ILq6ZbwIX5aPzcLNIZoePNp3Upxx+eCOG+iPbmI whSjIfLgM92KsH6kvKxYDIpnkx+RJfT2JPcTDisfIkgPuka+10OmdZV7BS1RxBKT resQutP4faMWtU1z49Nn0ZokQOqTvE7ZAXBj6sremKDt8uu2aaavcDnWkpKSsqXD 6fiq53T9kdp3mNK/Q9QnN3IEYMdhq+WIkmKSKUX8AmGby3wNVTLM0QSq76FLWzE3 WWcVIGllFFBwCg+2GK0Car+zet+SqcBTd4EMUJUT2Avy0WLVXxSFodF8pYN85FXy /CrRdyJYxoAoyy+8Qb8IFQ7CNfZeThJvm3YYAXAIV0Qvo7XtPiNcXsfjt1Oy512G lmi7vWweDdT7liF6Q7exd8dA1AyuM1p0yOqIXdYJiLo6zUtunJzS3uTmQ6KYUV/E lVv5c5CGmRKf+jBAls/1pVcybfncZpRZ9FnXiuFdmsfSmuu8yy0Vmu1GMmqV5MCq hHkalT8gqY7fXN1hLnlLxV8ymJIrKlOzN7TN8W0hKOUkEF1Am0eCvKbtEkQWAJ98 iQ== =oKGe -----END PGP MESSAGE-----
    - coderunner 11y ago
      Thanks! I appreciate it :)

343 points by doppp 11y ago

Congrats! Keybase has been making cryptography easier for me and everyone I know.

ejcx 11y ago

Good for them. I've been watching them quietly working hard, and it has been like that for a while now. Good luck! Hopefully some projects that make security completely invisible come about from this.

petesoder 11y ago

"We have a new goal: to bring public key crypto to everyone in the world, even people who don't understand it." Love the vision, guys. Huge congrats! Looking forward to seeing this one unfold.

mirimir 11y ago
That is indeed a great vision!
anfedorov 11y ago
People who don't understand what public crypto is, or the details of the mathematics behind it?

lisper 11y ago

An open-source, audited, encryption application based on NaCl already exists: https://github.com/Spark-Innovations/SC4 https://github.com/Spark-Innovations/SC4 I also have a keyserver that is currently in closed beta. Contact me if you want an invite.

zmanian 11y ago

One request Keybase friends... Can we get a forum or mailing list to discuss crypto design decisions, security etc on launch day?

fredley 11y ago

Congrats! Increasingly pessimistic as a British subject that I'll ever be able to use something like this without attracting the attention of my own government though.

zmanian 11y ago
Maybe you'll be okay in the UK? Still avoiding the UK like the plague right now... http://www.businessinsider.com/uk-government-not-going-to-ban-encryption-2015-7 http://www.businessinsider.com/uk-government-not-going-to-ba...
- raesene9 11y ago
  Unfortunately the headline for that article doesn't, to me, reflect the letter that's published at the end. They say that they're not targeting encryption directly, but they still say that they essentially want a back door into all communications systems, which is going to necessitate either getting technology providers to give them one, or banning of those that don't. (of course it also won't even come close to achieving their goal, but I somehow don't think that'll stop 'em)
signal11 11y ago
RIPA in the UK already allows for mandatory key disclosure if required by law enforcement: https://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom https://en.wikipedia.org/wiki/Key_disclosure_law#United_King... And intelligence agencies have been known to retain encrypted content for longer (in theory, forever): http://www.darkreading.com/risk-management/want-nsa-attention-use-encrypted-communications/d/d-id/1110475 http://www.darkreading.com/risk-management/want-nsa-attentio...? The older I get the more impressed I am with how prescient Scott McNealy was when he said: "You have zero privacy anyway. Get over it."

magicmu 11y ago

This is an amazing pursuit, and I wish you guys the absolute best! Unfortunately, I think public adoption of encryption will continue to be a problem until there is absolutely no barrier -- both in knowledge and UI design -- between the average user and encryption. This is a huge step in the right direction though!

_pius 11y ago

Happy to hear this, love what they're doing.

baby 11y ago

It's pretty awesome how simple it is to use. But why trust a third party to hold your private key? Why trust them to not store the plaintext when you encrypt/decrypt with them?

chrisfosterelli 11y ago
You don't have to trust them, you can use their open source downloadable client. The web interface is only for ease of use, and they make it clear that many people consider that "unsafe" compared to their desktop/command line alternative.
- teacup50 11y ago
  Yet they still offer it as the easy option, despite it being absolutely wrong.

zekevermillion 11y ago

Awesome! I hope some of this $ will help to shorten the waiting list queue...

coldpie 11y ago
Throw me an email if you'd like an invite. Edit: I don't have any more!
- DarkLinkXXXX 11y ago
  ditto
  - zekevermillion 11y ago
    I have now received an invite. Thanks for all the kind offers! Zeke
deckar01 11y ago
I just sent an invite to your adlervermillion address. To be honest I haven't found their service to be useful in my day to day life. I am mainly inviting you out of sheer guilt, because I have been accruing invites and not using the service. "Use your keybase account. There are insecure children in the US that write their passwords on post-it notes." ;)
- jedberg 11y ago
  I've been on it for a couple months now. I've used it twice: once was to exchange AWS IAM keys for a consulting job and the other was for someone to give me their credit card details. But in most cases it's just to track someone.
- zekevermillion 11y ago
  Thanks, appreciate it.
kstrauser 11y ago

chrisfosterelli 11y ago

> The Node reference client to our PGP directory will be retired. (PGP support will continue, of course.) Can anyone from Keybase shed light on the reasoning behind this? It sounds like you are moving away from programmer-friendly API libraries and into GUI apps. Even if they're open source, as a developer I really liked your up-front API. Will you still be providing those APIs?

malgorithms 11y ago
Oh, a clarification: the Node client will be replaced by the Go version. The `keybase` command line app will be a superset of what's available in the Node client now. Sorry. So yeah - still providing those API's. PGP support will continue, always, it's just that you won't need to have PGP on all your devices -- just the ones you use PGP on. Your PGP key will be part of a family of keys you're known by. If you install Keybase and have no idea what PGP is we don't make you get a PGP key. By switching to device-specific keys via apps on every platform, we can solve security and convenience problem at the same time. As the blog post says, this can only work if you can bring pairs of devices together. Which has only been possible and convenient the last couple years.
- chrisfosterelli 11y ago
  Ah, ok. Go binaries tend to be more portable and don't require npm, so I can understand that direction. Thanks for the explanation!
- jamra 11y ago
  It's about time for your obligatory /r/golang post about how you switched from 30 servers to 1 by switching to Go ;)
  - davidbanham 11y ago
    It's client-side code they're migrating rather than server-side. Fingers crossed it makes the CLI a bit snappier!
- 11y ago

davesque 11y ago

Very timely, considering the possible resurgence of the crypto wars.

bascule 11y ago

Hopefully they'll be able to address this then: http://i.imgur.com/3VAMerv.png http://i.imgur.com/3VAMerv.png (from https://twofactorauth.org/ https://twofactorauth.org/)

malgorithms 11y ago
Yes, addressed soon. The ideal answer for 2FA in a key-per-device app isn't really the same as the normal site + Google Authenticator / Authy kind of thing.

Redoubts 11y ago

https://keybase.io/jobs https://keybase.io/jobs is timing out (504). =)

hippich 11y ago

From my limited following keybase.io it seems like this is mostly hobby project. How does one get investment for this kind of projects? Do you need to know someone already? Or do you decide to pull a plunge and create business plan and present it on one of these demo days organized for investors? I feel like there is a huge gap between potent, but still hobby, project and series A funding.

jsprogrammer 11y ago
U jelly? I imagine you walk up to Marc and say, "Hey, we are building PGP for the world." Some days later, $10,000,000 pops in to your bank account. Edit: Would be considerate if the down-modders would provide an alternate scenario.
- rosser 11y ago
  Edit: Would be considerate if the down-modders would provide an alternate scenario. I'd imagine you're being downvoted more for the "U jelly?" childishness than the (im)plausibility of your (completely out of touch with reality) notion of how Keybase got their funding. That's why I downvoted, anyway; I saw your opening line, clicked the down arrow, and moved on to the next comment without further thought or consideration. Whether you agree with the mod-supported position that downvotes can legitimately be used as a form of disagreement or not, they're explicitly also meant to be used to discourage the kind of discourse that brings down the tone of the site. "U jelly?" certainly qualifies as that.
  - jsprogrammer 11y ago
    Thanks for your opinion. >"U jelly?" certainly qualifies as that. I'd argue that maligning keybase as a hobby project qualifies as much as "U jelly?". At least it is discourse, rather than an anonymous downmod.
    - rosser 11y ago
      It's a matter of tone. Whether you disagree with the Ur-parent's position that Keybase is — or, more accurately, "feels like" — a "hobby" project, the position was presented first as an individual's perspective, and second, was asking for clarification. He (?) wasn't saying, "Keybase is just a hobby project," but rather, "Keybase feels to me like a hobby project. How does something that seems like a hobby project get $10MM in funding?" Your response was low-brow dismissal, and not of the poster's position (you didn't respond to what they said), but of the poster (again, you talked about the poster, not what they said). Do you see the difference?

rnhmjoj 11y ago

Hacker news managed to kill even keybase.io.

pjlegato 11y ago

The fatal problem with this plan is that all end user devices are by now hopelessly compromised. Take a look at the Snowden documents, which are now years behind the state of the art. It doesn't matter if your crypto is both bulletproof and easy to use. They'll just break into your phone or your laptop through a side channel and read the key. And you won't even notice.

deleted 11y ago
[deleted]
cpach 11y ago
Have it ocurred to you that different people have different threat models? Yes, if a powerful state actor really is after you, they will most probably find a way sooner or later. Crypto is still useful for lots of use cases. E.g. protecting data from competitors, stalkers or identity thiefs.
- pjlegato 11y ago
  This sort of thing may have been limited to powerful state actors a few years ago, but now Pandora's Box has been opened. Many other actors are now actively exploiting the holes deliberately created in the entire stack of computer security infrastructure over the past 20 years by those state actors. It's far more likely that you'll run into someone trying to steal your credit card than an intelligence agency, but they'll be using the same exploit to get into your phone.
  - cpach 11y ago
    So the only resort then I guess is to abandon computers and only use cash and pen and paper.
    - kajecounterhack 11y ago
      Nobody's saying that. I think what's being said here is just that we need to fix what's broken. Acknowledging that your physical devices have side channels is important.

jamra 11y ago

I once thought of doing the same for medical information. I am really excited and eager to see you succeed. It's a shame that America does not offer some kind of national repository, but at the same time, it's great that you can tie a user's own data to his consent. It all works great for non emergency situations. Good job getting the money. I hope you can get the work done too.

tunafishman 11y ago

Really well written. Kudos to whoever wrote your copy!

realusername 11y ago

I have a small question here for the people who use keybase and it's been difficult to find answers for this. How do you encrypt per email address ? is that even possible ? I would like to use it for a personal project of mine and that would be the use case. (Sorry to hijack this thread, it might be interesting for other people). Congratulation to the whole team for your hard work !

coldpie 11y ago
I don't know what you mean by "encrypt per email address." Who is doing the encrypting, and to who? Do you want to have multiple keypairs associated with a single keybase account?
- realusername 11y ago
  You can encrypt with lots of things, for example $> keybase encrypt twitter://twitter_id -m 'message' But there seems to be no way to to it with an email address like this: $> keybase encrypt email://email@example.org -m 'message' Or maybe I did not understand something.
  - coldpie 11y ago
    Yeah, email's a bit more complicated than twitter. I think for the time being, you want to just encrypt to a file and attach that. Maybe there's a standard (PGP mail?) that keybase could output to a file, but that doesn't tend to play well with the GUI mail clients that people typically use.
    - realusername 11y ago
      Thanks for your answer. The main goal on my case is to use the email address as an identity (since it's currently the closest thing I have for this) and not to send encrypted PGP email messages. That's why I never really understood keybase. You can encrypt with a twitter id but not send a encrypted tweet with GPG anyway, so why can't you encrypt by email ? I assumed the most basic form of identity is an email address. Thanks again for your answer.

higherpurpose 11y ago

I wish we didn't push outdated crypto protocols such as PGP. So many companies seem to want to invest money or development time into making PGP "better" - with one exception: they can't make it forward secure, which I think is absolutely critical in today's world of companies and individuals "losing everything" in a hack. Investing in a protocol that will last another 20 years and doesn't even have forward secrecy seems like such a wasted opportunity. It feels like one of those things where 20 years later you think "I wish we hadn't done that then".

irq-1 11y ago

Keybase is the wrong way to do a PKI directory. First, people should have multiple keys/identities by default; multiple identities should be the normal thing everyone does. Single identities will be used by governments to control people. They'll also work against normal communication patterns where people speak differently to different groups (think parents, friends, coworkers.) Second, matching a name with social media is the wrong way to lookup others. It only works if people put enough personally identifiable information (PII) on their social media accounts, otherwise we won't be sure we found the right person. This matching system encourages PII, works against multiple identities, and associates multiple accounts on disparate systems. Everything you told Facebook, you've now told Reddit and Github, etc.. because the companies can also lookup your (single) Keybase identity and connect the accounts, as can advertisers and governments. Third, leaving people to manage their own private keys is worse for security than having them managed by others. Software changes, glitches and upgrades should be overseen server-side and managed; there should be a help-desk to contact and backups should actually be done, etc... Multiple identities would make it easy to let an employer manage an 'employee' identity, and Facebook manage -or consume- a public 'personal' identity, and Twitter manage a private 'political' identity. (A PKI version of OAuth and 'Sign in with Facebook'; strong crypto can't fix the UX problem.) I think the winning solution will be: a distributed, server-side PKI system that individuals and companies can host themselves; a DNS-like distributed registration and searching system; a host-provided web UX for managing accounts. Moving private keys to the client will work better if the local key is signed by a hosted key, rather than leaving all the private keys in the hands of end-users.

hellbanner 11y ago
Great response. Do you think there's a way to monetize this proposed solution?
nailer 11y ago
> Second, matching a name with social media is the wrong way to lookup others. Assuming it /is/: a well known social media site called Facebook already has a space for GPG keys. That doesn't mean keybase can't succeed and I do wish them luck though. First step: buy keybase.com, because people who don't know what encryption is don't understand .io domain names.

chinathrow 11y ago

Why the invite thing? Really? Why shorten artificially on who you let in?

jamwt 11y ago
Referral trees let you control abuse; if someone suddenly spawns lots of accounts via nested referrals for abuse, you can just cleave off the appropriate subtree.
- chinathrow 11y ago
  Really? How can they publicly state that they promote security and open source tools while denying anyone access who like to use the service?
  - VLM 11y ago
    You're not really using the service, you're connecting to "the" web of trust (Are there disconnected non-contiguous islands on keybase? Only the admins know, probably). That makes me feel "meh" about giving out my invites to random HN users. I mean, if you're not going to connect to me, or the rest of the WoT, then what value do "we" get from you joining, and if you're not going to connect to me, or the rest of the WoT, then what value do you get from my invite? Now what I don't understand is there are existing large WoT in GPG keys and they "shoulda" given like 1000 invites to anyone with a debian.org developer key because thats a community of deeply connected very long term WoT (well, more or less). Find someone in your existing WoT who is on keybase and they probably have invites and will give one. I have invites. I will give them out to anyone in my existing WoT who asks. If they aren't in my WoT then theres no point for them to ask, or me to give. Even friend of friend or more distant, not just signed each others keys. This also creates a dilemma where I have to keep a stockpile of invites in case some I closely connect to "needs" an invite. So FoFoFoF of some guy I met at a HOPE conf might not get one of my invites because I need to save it in case my coworker finally gets off his butt and signs up and he needs my invite. This is rollout mistake two, I should be able to request via a form or something "I have a really good excuse now gimme an invite". However they're AFAIK randomly granted over time or something.

keybase-please 11y ago

Can someone please send a Keybase invitation to: keybase-please@Safe-mail.net This help would be appreciated.

ddworken 11y ago
Just sent you an invite. If anyone else needs an invitation, I still have 8 left. Shoot me an email or reply here if you want one. Edit: 6 still left.
- tanderson92 11y ago
  Please? tanderson@exherbo.org
- keybase-please 11y ago
  Thank you!
- ddworken 11y ago
  I'm all out, sorry everyone.
- befwi 11y ago
  Please ? befwi@live.fr. Thanks

jtwebman 11y ago

Congrats guys! I had played around with this 6 months ago. Looking forward to seeing what you guys build.

snissn 11y ago

Do they have any sort of monetization plan or strategy?

OJFord 11y ago
Yes, see the blog post ..?
- snissn 11y ago
  Ah, thanks I didn't make it that far

chinathrow 11y ago

I just looked at the source of the page: A) external CSS which might leak about a visitor to Google B)  No 3rd party JS: good. Still leaking visitor info: bad.

malgorithms 11y ago
hah, I forgot about that note. Good point - our stance was to protect from targeted code injections (by a coerced or hacked Google). But of course you're right, there's no point letting Google know at all. I've made an issue to move font/css hosting off Google.
- chinathrow 11y ago
  Thank you very much - great reaction.
- brandon 11y ago
  You might also consider setting Content-Security-Policy headers to enforce your intent. http://content-security-policy.com/ http://content-security-policy.com/

taf2 11y ago

Grats @gabrielh!

stuartaxelowen 11y ago

It feels like their growth strategy is "make security decisions for other people".

jgalt212 11y ago

> Chris Dixon championed the deal; he’s known for his visionary investments, ranging from Soylent to Oculus to Airware. Pretty strong language there (and definitely not provably true or fale), but I guess bold phrasing is what SV is known for.

foote 11y ago

The Terms and Conditions for Keybase.io seem lopsided (https://keybase.io/docs/terms https://keybase.io/docs/terms). Why is that?

reviseddamage 11y ago

>server-side PKI system that individuals and companies can host themselves It is not possible to deploy this to the mainstream who probably need encryption the most. Keybase's mission iirc is to bring encryption to the masses without having to learn about encryption. It is imo the best alternative to the status quo, i.e: no encryption.

xanderjanz 11y ago

Doesn't this just set up a central failure point? Does Keybase have a forward secure key system?

whodges 11y ago

Wonder just how secure the @keybase.io email part of this is going to work? Would you have to load this email into a client or would you just pull down the email in Node? Thoughts anyone?

ahuja_s 11y ago

This could help solve the personal identity verification issues associated with smart contracts and such. This is one of the key problems with the Ethereum project too.

lelininkas 11y ago

"Your mom is on LinkedIn and Facebook, downloading toolbars." I laughed too hard at this. To be honest I still am.

OrangeTux 11y ago

I've still some invites left, who want one?

coderunner 11y ago
Hi, I'd be interested in one if you still have any left. My email is captainlinger2000@gmail.com if that's what you need to send an invite.
- OrangeTux 11y ago
  Done -----BEGIN PGP MESSAGE----- Version: GnuPG v1.4.12 (GNU/Linux) owEBOgLF/ZANAwACAert2DDXuRFrAcsKYgBVp03FRG9uZYkCHAQAAQIABgUCVadN xQAKCRDq7dgw17kRa6MIEACX5rLZo7t+Wt+0NYBaIQd3JPY0A/5TxPec8bKa2k6/ Mj1Gg9Dl+UJ0GB9WXraYiWz65BhwjsyyI0ZCtisRJ/pprr7adMi5uRs0W6HgydEh ixm9FEqHsH4jjwr2gmfb8Xs2+ILq6ZbwIX5aPzcLNIZoePNp3Upxx+eCOG+iPbmI whSjIfLgM92KsH6kvKxYDIpnkx+RJfT2JPcTDisfIkgPuka+10OmdZV7BS1RxBKT resQutP4faMWtU1z49Nn0ZokQOqTvE7ZAXBj6sremKDt8uu2aaavcDnWkpKSsqXD 6fiq53T9kdp3mNK/Q9QnN3IEYMdhq+WIkmKSKUX8AmGby3wNVTLM0QSq76FLWzE3 WWcVIGllFFBwCg+2GK0Car+zet+SqcBTd4EMUJUT2Avy0WLVXxSFodF8pYN85FXy /CrRdyJYxoAoyy+8Qb8IFQ7CNfZeThJvm3YYAXAIV0Qvo7XtPiNcXsfjt1Oy512G lmi7vWweDdT7liF6Q7exd8dA1AyuM1p0yOqIXdYJiLo6zUtunJzS3uTmQ6KYUV/E lVv5c5CGmRKf+jBAls/1pVcybfncZpRZ9FnXiuFdmsfSmuu8yy0Vmu1GMmqV5MCq hHkalT8gqY7fXN1hLnlLxV8ymJIrKlOzN7TN8W0hKOUkEF1Am0eCvKbtEkQWAJ98 iQ== =oKGe -----END PGP MESSAGE-----
  - coderunner 11y ago
    Thanks! I appreciate it :)