malgorithms

10 ms·

61.
by malgorithms 9y ago
Like everything else Peter Todd does, this is very impressive and extremely useful. And I think it's almost what we need at Keybase for timestamping our own database. I figured I'd record here what's important to us in a ti
62.
by malgorithms 9y ago
From the beginning of Keybase, we considered this specific user flow very important. (1) if there's no one on keybase who matches your "assertion", say a certain twitter account or HN account or whatever, (2) the keybase app
63.
by malgorithms 9y ago
yes, but to be clear: an identity proven by your PGP key is still considered "you" for chat/KBFS, as your device keys have transitively said that PGP key is you. So (1) PGP proved twitter (or whatever), then (2) PGP signed in
64.
by malgorithms 9y ago
yup!
65.
by malgorithms 9y ago
Almost 100% correct :-) First part: if you lose or wipe a phone and want to reprovision, the lost device's private key is GONE. It will not exist in some icloud backup. When you provision your new device, the Keybase app will make fres
66.
by malgorithms 9y ago
Oh HN, so much for a soft-launch! (But thanks for all the positive comments on here.) We've been testing Keybase a lot with iOS and Android testers and we quietly released into the app stores last night. In many ways it's an MVP f
67.
by malgorithms 10y ago
and for now if anyone hits this, just use the invite code `zcash`. We've left that bypass code working since our recent blog post.
68.
by malgorithms 10y ago
we knew we needed a logo redesign no matter what; the old didn't scale well. The new one looks good at small sizes - say in a menubar or as a small icon. Of course that's just an opinion, but our team is happy with it. In old disp
69.
by malgorithms 10y ago
For program-to-program talking, use the "dev" channel, in a topic of your choice. (By default --topic-type=chat and changing it to dev keeps it out of the GUI) For example: keybase chat send friend1,friend2\ --topic-type=de
70.
by malgorithms 10y ago
We didn't design Keybase's chat API to match any messaging standard, but the number of calls into it are very few and flexible, and we're open to change. As it is right now, I imagine it would be very easy to write a library
71.
by malgorithms 10y ago
oh, great question! I wish I'd been clearer in the post. Encrypted messages waiting for others are stored on Keybase servers. But they're encrypted only for the sender . The important requirement of this protocol is the removal o
72.
by malgorithms 10y ago
OP here! I had to trim the post down for brevity, but I thought the HN community in particular might be interested in the API side of things. Undocumented in the post: you can invent channels for app-to-app communication from the JSON API.
73.
by malgorithms 10y ago
> Aging, too, has conventionally been seen as a trait dictated by evolution. Organisms have a lifespan that creates opportunities to reproduce, the story goes, without inhibiting the survival prospects of offspring by the parents stickin
74.
by malgorithms 10y ago
Internally (I work at Keybase) we use it even more for the opposite. We do use it for secrets, but very often we put public info into KBFS we want to verify. As an example, a number of us use it to address pain points around SSH. I keep thi
75.
by malgorithms 10y ago
Author here. Seeing some of the discussion go down on Twitter, I feel maybe I should explain further the "white supremacist" example in the post. (one tweet at me: "So now you can hide the fact that white supremacists are se
76.
ZCash (formerly Zerocash/Zerocoin) technology preview(z.cash)
240 points by malgorithms 11y ago|109 comments
77.
by malgorithms 11y ago
Oh - it was an encrypted message to the OP. Here's something general: BEGIN KEYBASE SALTPACK SIGNED MESSAGE. kXR7VktZdyH7rvq v5wcIkHbrvAOc8o HtD9ll30QZYRrt1 63n5tVSjvbZwtwt nQVqdDHEZIYWqWk 57rCih2L43U8D3v uDU7bYeatPFXDSw ZikNjVdebkJIL
78.
by malgorithms 11y ago
You can read this by piping into: `keybase decrypt` : BEGIN KEYBASE SALTPACK ENCRYPTED MESSAGE. kiZ8aa8yNOPC2nP QD3QM6XxeDcurpU PZqSleTgKxgp9sd hCuooQmObarwJ3s nyWrixKOA2h8EWj 6ngTHMGf1nOnrwq 2hjkFzgNR2q2bcZ AMxPfhM5vvYEPHy HoWuLF9LYW6TQJH
79.
by malgorithms 11y ago
Oh I see, sorry for not fully answering. Keybase does not merge files or anything source-control like that. In fact, if that's what you want, you can actually init a bare repo inside of Keybase and clone into and out of it. We do this
80.
by malgorithms 11y ago
We are testing a build for Windows that uses Dokan. Early results have been very positive. It's an important feature of KBFS that it can run on Windows.
81.
by malgorithms 11y ago
It works to repeatedly append to a file on one machine and `tail -f` it on another. Even an encrypted file. It just works. As for collisions, a "conflict" is handled as you would expect on file syncing services, although all confl
82.
ZCash (formerly Zerocash/Zerocoin) technology preview(z.cash)
2 points by malgorithms 11y ago|1 comments
83.
by malgorithms 11y ago
These 2 docs together will explain it: [1] https://keybase.io/docs/server_security [2] https://keybase.io/docs/server_security/merkle_root_in_bitco... The tl;dr: Removal statements are signed
84.
by malgorithms 11y ago
The simple idea is that it's a directory mapping public keys to social accounts. If I know you as a Twitter user, I might want to send you an encrypted message. Or if I get a message from you that's signed, I might want to know th
85.
by malgorithms 11y ago
> "I'm not sure that I'll use the new keying system (my use case isn't very risky)" To be clear, you'll be using this system automatically if you install Keybase on your phone or desktop. It'll just wor
86.
by malgorithms 11y ago
Details, in case it's helpful/interesting to anyone: https://keybase.io/docs/api/1.0/call/login . Also of note, the hashing is done client side, not server-side.
87.
by malgorithms 11y ago
Keybase is! NYC / SF / CHICAGO We're a tech-heavy team of 12 engineers and 2 designers, based in NYC, SF, and CHI. We are hiring specifically in those 3 locations. We love these people: 1. Go developers; crypto experience
88.
by malgorithms 11y ago
hah, I forgot about that note. Good point - our stance was to protect from targeted code injections (by a coerced or hacked Google). But of course you're right, there's no point letting Google know at all. I've made an issue
89.
by malgorithms 11y ago
You laid out a number of points there, and I think some of them are indicative of what's really holding back security for the masses. "Matching a name with a social media is the wrong way to lookup others" -- this is the one
90.
by malgorithms 11y ago
Yes, addressed soon. The ideal answer for 2FA in a key-per-device app isn't really the same as the normal site + Google Authenticator / Authy kind of thing.

More ›