Keybase is a really cool solution to a problem (or problems?) I don't seem to have.

I've had an account for a while but don't really have any reason to use it.

Seems like they're pivoting towards being a Slack competitor. Maybe if they open sourced the server portion it could be a chat solution that OSS projects can feel okay about using.

Keybase is a great way to do company onboarding. Have a new employee setup a Keybase account (if they don't have one already) and now you have a simple and secure way to have conversations and exchange files (e.g. W-4 forms, insurance, etc)

I use it for personal communications too, so it is nice to use the same secure messaging platform for both work and personal and switch back and forth from computer to phone easily. I do wish the server portion and apps were opensource though.

Hm...

I wonder now could it be used for corporate secret management. I wouldn't like to use cloud solution for that and on existing on premise solutions do not cover all scenarios I need (on-boarding one of them, or guests).

Looks like Keybase Teams is exactly for that:

https://keybase.io/blog/introducing-keybase-teams

Like 2 years ago, Rob Pike announced Upspin to much fanfare, which is a full OSS implementation of more or less the same thing as Keybase's KBFS. Since then, I haven't heard anything else about it. I tried using it for a little bit and it worked really well. anyone around here still use it, or know it's status?

If anything, I really like it as a file-storage option. 200GB (maybe they lowered the amount?) and encrypted and seamlessly integrates with my file-system (except for having to update Dokan on Windows).

Is someone using these 200GB? It seems slow.

Uninstalled because on Windows it registers itself to auto-start on boot no matter what you do. I keep removing it from the autostart places and it keeps registering back.

I get it that they want to get usage telemetry, but it's ridiculous for a security focused app to force itself like that.

https://github.com/keybase/keybase-issues/issues/2380

https://github.com/keybase/client/issues/3904

https://github.com/keybase/client/issues/5990

They don't seem to prioritize user choice on the linux version either, there's no snap/flatpak available nor a user friendly option to not mount the FUSE filesystem.

https://github.com/keybase/client/issues/8264

https://github.com/keybase/client/issues/9191

https://github.com/keybase/client/issues/7846

The annoying part is that the operating system allows this and doesn’t have a good way for users to restrict service startup.

Still waiting for 2FA authentication (sigh) ... everyone but Keybase and my bank seems to know how important this is!

2FA is not very helpful if your service relies on encryption for everything (like keybase). It's not possible to use 2FA without another party verifying the authentication code. Keybase could include this (then they would have to verify it), but so far keybase has gone to great lengths to not actually have to hold any secrets for users. They even perform password hashing in the browser instead of on their servers. 2FA would force them to do some processing with secrets on the server side.

Having 2FA with Keybase would be similar to having 2FA with a local password safe like Keepass. Yes, you could implement 2FA. However, you would have to rely on an external service, and if people have your password and can modify the software, they can simply comment out the 2FA check and they can decrypt your password safe.

The entire security model of Keybase is based on having all data encrypted at all times. Adding 2FA would add some false sense of security, which doesn't affect the encrypted data at all.

I disagree, having a single password is a risk even if all encryption is done locally.

Why not use an M-of-N / 2-of-3 encryption scheme where the user can optionally have Keybase protect one of those keys via a 2nd factor. The user would keep the 3rd in the form of a yubikey or simply written down and physically secured.

This could improve both usability and security and Keybase itself still doesn't have access to your data.

> It's not possible to use 2FA without another party verifying the authentication code.

That's not true. You can verify the time based codes or do u2f yourself. You don't need a third party for that.

Right, but there's no way to cryptographically enforce that. All the totp implementations I've seen are symmetric, with the validating server running the same calculation from the same seed. You could do that locally - but then the seed can be extracted or a client can be patched to just not request the code in the first place.

Where would you want 2FA to be added? When setting up a new device?

Ist there already 2FA for that?

You need to know the password and be in possession of a device already trusted to confirm a new device, right?

IIRC you don't need the password when setting up a new device. I might be misremembering that, though.

You certainly need to be logged in to keybase on an existing trusted device, though.

I really want to love Keybase but nobody (meaning my wife and friends) will use it because the performance for basic chatting sucks abysmally on mobile (plain text chat works but things like pasting an image don't work, for any wife-acceptable value of work).

This means I haven't wanted to even suggest trialling it at work, so I haven't used the teams feature at all and without that it's basically an encrypted cloud storage mechanism with an interesting Git integration.

    T_T

The git integration is indeed something really cool.

did anyone figure out what the arrow on the top does?

https://i.imgur.com/nqGfSCL.png

It appears to be a "back button", e.g. if you click through some sub-menu items on the settings screen, you can see it clearer and it has this functionality.

By its looks, it should hide the side bar...

except it doesn't, it's actually a back button

I use it with my friend to share ill... No I mean to share stuff like videos ;-)))