malgorithms

7 ms·

121.
Keybase releases its PGP implemenation for Node.js/browser(keybase.io)
7 points by malgorithms 12y ago|0 comments
122.
by malgorithms 12y ago
Related: Daimler has a PGP policy. Whoever works on their email likes to get things done. Last year I emailed a car dealer who worked for Mercedes Benz USA, and I got an auto-reply from Daimler that my signature was unacceptable because the
123.
by malgorithms 12y ago
yes, the premise here is that the Keybase server can be caught lying. If you want twitter user X's public key, Keybase can tell you the key and which tweet to look at to verify it. Then you can check it yourself. OAuth doesn't all
124.
by malgorithms 12y ago
Totally appropriate. I should say that we don't really want to be in the business of building general crypto apps ourselves, but Keybase identity proofs can make a bunch of things possible. Anything from financial transactions (send a
125.
by malgorithms 12y ago
Yes; here's a tl;dr: for a given user, all of their signatures form a chain of signed statements, where each one points at the previous statement. They don't have to be the same kind of statement: your identity proofs, your track
126.
by malgorithms 12y ago
I should add that we're not fundamentally opposed to some kind of query language in the API requests, but most of our API objects lend themselves pretty well to just passing a list of fields you want. The above technique is very simple
127.
by malgorithms 12y ago
An update on Keybase, since it was chosen as the example. The API now supports field declarations. For example, these all work: https://keybase.io/_/api/1.0/user/lookup.json?username=chris&fields=
128.
by malgorithms 12y ago
Happy to see one of our Keybase API responses used as the example here. I can share our intentions with that API call in the long run, and how it'll end up smaller, which is especially important for mobile devices. The dictionary descr
129.
by malgorithms 12y ago
Very cool! Tested my site before and after a patch, and it recognized the fix. A quick UI tip: you should give some indicator while the test is running. I couldn't tell anything was happening while I waited. Even just a spinner gif of
130.
by malgorithms 12y ago
While we like being #1 on Hacker News, bad (good?!) timing is what earned us this spot. It will be the case very soon that you can push your key to Keybase and prove all your identities, without ever installing the client the OP dislikes. T
131.
by malgorithms 12y ago
yes, sorry if that wasn't clear. What I'm saying is that we'll have them documented very shortly. It's a priority for us, which I believe will address the OP's issue. We'll have documentation on: - what needs t
132.
by malgorithms 12y ago
I can answer this for Keybase: first off, it's not because we can't learn other languages (someone suggested that below). In fact, we spent 10 years programming OkCupid in C++, and we've built some high performance projects i
133.
by malgorithms 12y ago
Yeah, thanks for making this issue. (Chris here, one of the two working on Keybase. I commented on that issue recently.) Getting proofs working totally outside our alpha client (and getting them well documented) is something we're work
134.
by malgorithms 12y ago
On the IM side of things, you should check out OTR (off-the-record messaging): https://otr.cypherpunks.ca/ - in particular check out the top 4 goals mentioned on that page.
135.
by malgorithms 12y ago
The client verifies the key by checking that the signed tweet, gists, etc., all exist and were signed by the private key that matches that public key. So to get the server to successfully lie, one would need to coordinate lies from twitter,
136.
by malgorithms 13y ago
Please don't disclose the transaction. It's a serious decision, at least.
137.
by malgorithms 13y ago
Hi riquito - this is a very legitimate concern, and it has to be reviewed individually for each type of proof keybase supports, in the client. With twitter, keybase, and github, you can't have a username containing any character other
138.
by malgorithms 13y ago
To clarify the difference, it seems encrypt.to is a service which does PGP crypto in the browser, based on keys pulled from keyservers. In contrast, Keybase is an identity-proving service, which proves key X belongs to person with twitter
139.
by malgorithms 13y ago
confirmed, yes! Caroline is doing both the artwork and the site design. She's a wonderful artist and we're lucky to work with her. Note the site isn't done yet, so anything that looks funny or imbalanced is not her fault but
140.
by malgorithms 13y ago
boss, I'm glad you answered this question. Because it explains the impetus for Keybase. I think what Keybase is addressing in the status quo is twofold: (1) sadly, almost no one does what you describe; in person meeting key exchanges a
141.
by malgorithms 13y ago
yes, it does do this; once you're satisfied with maria's identity, that she's the person you want, you sign a statement to that effect, which you can store just locally or post back to the server. (or of course you can just s
142.
by malgorithms 13y ago
There were multiple questions/comments below about this, so I felt I should clarify one detail about the keybase client's trust of the server. When the keybase client requests maria's key from the keybase server, it does not
143.
by malgorithms 13y ago
Hi addisonj - sorry about this. The site is clearer about this limitation. If you request access via the site now (just click join on there) and remind me this happened to you in the comment field, I'll move you forward in the queue. S
144.
by malgorithms 13y ago
Good question! There will be no such thing as a general check, because -- for any identity -- the client software has to perform a check that a human would agree means something. For example, what does it mean that you own a certain blog?
145.
by malgorithms 13y ago
Hi everyone, Chris here, I've been working with Max on Keybase. I can't help but feel this ended up scooped a bit early. (Crap!) Not a surprise, because HN is quick. The alpha site's changing every day, and we're workin
146.
by malgorithms 13y ago
Quick tip: I really wanted to try this app, but I didn't trust it to "find my friends", i.e., read my contacts. At first it seems you can't skip that step, but I force quit the app when it showed me the "find my fri
147.
by malgorithms 13y ago
Nope, it was a totally new site, new userbase. We learned while building SparkMatch that we wanted to do dating. But when we started OkCupid, we had all left the TheSpark/SparkNotes a bunch earlier, and there was nothing from SparkMatc
148.
by malgorithms 13y ago
I once answered the question of our launch strategy for OkCupid on Quora (here: http://www.quora.com/OkCupid/What-was-OkCupids-launch-strate... ). A few things I can add: 1. You're right in thinking that bootstrapp
149.
Python TripleSec encryption(keybase.io)
8 points by malgorithms 13y ago|2 comments
150.
by malgorithms 13y ago
It couldn't be them - this was an odd number of bitcoins.

More ›