Keybase launches encrypted Git
keybase.io
keybase.io
From an entrepreneurial perspective, this is my favorite thing we've done at Keybase. It pushes all the buttons: (1) it's relatively simple, (2) it's filling a void, (3) it's powered by all our existing tech, and (4) it doesn't complicate our product. What I mean by point 4 is that it adds very little extra UX and doesn't change any of the rest of the app. If you don't use git, cool. If you do, it's there for you.
What void does this fill? Previously, I managed some solo repositories of private data in a closet in my apartment. Who does that? It required a mess: uptime of a computer, a good link, and dynamic dns. And even then, I never could break over the hurdle of setting up team repositories with safe credential management...like for any kind of collaboration. With this simple screen, you can grab 5 friends, make a repo in a minute, and all start working on it. With much better data safety than most people can achieve on their own.
Signing tags are not as affective as you'd think. refs are never actually signed, it's the objects they are pointing at that are signed. This opens up to interesting attacks where you can move refs around to previous vulnerable versions.
Git also never checks if the metadata the tag points at is correct!
Interesting paper: https://www.usenix.org/system/files/conference/usenixsecurit...
First version in shell with a fairly robust test suite, and the next version in Rust. Originally started to do it in Rust, but libgit2 was sufficiently obtuse that we opted for getting to a complete, working thing first.
I say that in full realization that 99% of people probably don't even know that you can sign commits, but the first point doesn't seem valid, as you can ensure integrity of commit history.
Identity continues to be the key selling point of keybase. I'm excited by this.
I can keep clones of my private repositories here. Things like dotfiles and configurations. That sounds like a good start. And I can also easily share code to people who need to see it.
https://github.com/anishathalye/git-remote-dropbox
Hosing your repo is way too easy otherwise.
git-remote-dropbox works as you would expect a Git remote to work; it's API-driven and actively discourages even syncing the remote repository down to your machine. I would so, so strongly suggest you switch to it if you want to use Dropbox as a store.
Bare-git-repo-on-KBFS is inadvisable for a similar reason, which is why I'm so excited to see what they're doing here.
Both have the possibility of breaking because of concurrent or delayed syncs--like, which is actually HEAD?--but the latter is probably safer than the former. Or you can just use git-remote-dropbox and never have a problem.
If you always, always-always, develop on a single computer, Dropbox-as-normal-file-system can be fine. But if you have a desktop and a laptop, or multiple people partying on it, I get worried. :)
I expect that this could break the bare repository on DB if I ever pushed from two places simultaneously (where "simultaneously" could potentially encompass a period of hours or days if I pushed from an offline computer) but I should be able to repair it by recreating the bare repository.
Using something like git-remote-dropbox seems like a good idea. But at this point, I can just start using Keybase, hooray!
Thanks for the info about git-remote-dropbox and the potential failure modes of going without, even if they don't all apply to the way I've been doing things. It's still not ideal, so here's hoping Keybase makes it obsolete. If not, I'll keep git-remote-dropbox in mind.
I don't think it's necessarily silly; it can be very useful in some scenarios.
I keep all my local working copies in a folder synced across several machines. I use Resilio Sync because it is better[1] than Dropbox for this purpose, but it's basically equivalent.
What this lets me do is stop working suddenly, at any moment (baby crying upstairs, or I lost track of time and have to bike to the office for a meeting) get up from my computer and move to another one (in another room in my house, or across town at my employer's office).
The code doesn't have to be in any finished state, needn't compile, I can literally be right in the middle of a line of code. As long as I've saved my work to disk, it will have synced before I reach the next computer, so I can sit down and resume work.
Before I had kids I didn't need this as much, so I just did git push/pull.
But then you have to do the work of pushing your half-finished junk to a different private repo, or rebasing to avoid polluting the git history with a bunch of crap commits just because you had to move, or not do that and just accept having a git history filled with crap.
Frankly I wish more of my work was capable of being distributed like this, but it's really only suitable for collections of plain files, which are amenable to being synced file-by-file. Luckily that includes almost all my programming work, however.
[1]: Resilio Sync is better than Dropbox for this because: it is much faster to sync than Dropbox, it supports symlinks so it doesn't corrupt your data when syncing folders containing them, and it syncs my data only among computers I control, not to any cloud service.
How is Keybase gonna make money? How am I assured that this, and everything else in my Keybase storage, is going to be there in six months? Like, I still have a private server in a closet in my apartment that syncs all the stuff I trust Keybase with because I don't know what the business-side failure case is.
You guys should be taking my money, is what I'm saying. Also probably hiring me. But definitely taking my money.
Completely agreed. The reason I don't use Keybase more than I do is because I half expect them to be acquired/something else to happen. Would gladly give them my $10/mo. for a 1TB instead of Dropbox.
With that said, I completely understand why they aren't right now -- maybe they're not going after the consumer market, maybe they don't want to box themselves in with customer support obligations, etc. But I really would like to use them.
Maybe this applies only for the git?
Of course to achieve our goal, we'll also have to find a way to distinguish communities - which we'll want to use Keybase for free - and companies.
Many of us on the team have come from ad-supported businesses and we really, really never want to do that again. I personally guarantee I will never be a "publisher" again. Fortunately that just can't work with Keybase, so no fears there.
But charging for anything on Keybase right now would be a big mistake. We only have ~180,000 users, and we want to bring crypto to everyone. That basically means making products we believe are better.
Another way of looking at your concern: I think if we were charging right now, it wouldn't actually decrease the odds we disappeared in a few years. It might distract our attention from working on the best product and cause our bloody demise. So maybe we're not choosing the path that gives you the highest impression of safety, but I think we actually are.
So prove it. Provide a way that customers can try to give you money for solving their problems. Even if it is just a dummy static page with a form to contact your "sales" department, really show that you will be here for the longer term.
Sales and being around long term are more complicated and won't simply be proven to you because it's what you want. It requires more vision and coherence than that.
It could be an option when you log in to the UI. I wouldn't mind it, as long as it isn't being e-mailed to me every week/month.
> That means that our highest priority is removing any obstacles to adoption. Anything that people might use as a reason not to use Trello has to be found and eliminated.
In this case I am weary of using something like this that is free because I have seen so many things in the past that were free only to shutdown rapidly after they grew in size, but with no way to pay for themselves and had to pivot or sell out. So being free is actually an obstacle in adoption.
Personally I'm old enough that I don't have to try every new service, but if something is solving a real problem in the short-term, I will give it a try and hope for the best. Keybase is definitely in this bucket. Worst case they go away and I have to come up with a different solution, but right now it's adding tremendous value.
but what's the alternative? Stable companies also kill
or abandon projects.
Nobody shuts down a project that costs $500,000 per annum and brings in $1,000,000 per annum.
Of course, 'all costs' there doesn't just mean employee salary - it has to include difficult-to-measure costs like the opportunity costs of the attention it demands from executives, paying a portion of the support costs of any legacy systems it needs, and suchlike.
That being said, I think Keybase is one of the most important companies around right now. I would gladly pay $10/month, even if literally all it did was put a "Supporter" badge on my profile. I'm sure hundreds of other people agree.
Crypto is far too important for it to remain locked away behind GPG.
For what it's worth, I think my above comment is my highest upvoted comment of all time. There's a lot of people out there who want Keybase to succeed.
With all the products you're offering, is there any indication which products will be staples of Keybase? Eg, I'm always hesitant of the "Google Product", where something gets added only to be abandoned ~1yr later after it doesn't gain the traction the company expected.
For example, I'd love to get my wife and I switched to Keybase Chat from Telegram. With that said, I love the features of Telegram, they're killing it for me honestly, but I can't expect Keybase to compete with Telegram unless they're really invested in it.
So which products from Keybase are one-off experiments, and which are long-roadmapped products - expected to have continued development and support for years to come? I'm having trouble understanding what to trust.
Note, none of this is critical to Keybase. I'm wary of startups in general, despite loving you guys, so I'm just seeking understanding. I appreciate whatever information you can give me, even if small :)
In case of chat you can always fallback to Telegram (I've done that after trying to move people to Wire).
In case of git you can always move the repo.
With the setup that's there now I can see how it could be used as the main origin along with a push to GitHub hook. Pull requests would be even mergable (blessed be Torvalds), though I'm not 100% sure if GitHub would pick up on that and autoclose the PR.
Thank you, thank you, thank you.
It seems to me that there's a lot of product opportunities in the corporate world that go beyond what Keybase is providing today. Chat and Git are interesting, but there's already a lot of momentum in both these areas. Been thinking how I use encryption and where things fall short today. One of those areas is build signing and hardware key management for our team.
Everything that goes on our servers get signed by an official PGP key. Only a couple people can sign builds, and each has a Yubikey with PGP subkeys on it. This is kind of annoying to manage. We use an airgapped computer that houses the private key, can create subkeys and assign to Yubikeys, can handle expiration management, etc. When we want to deal with this, we have to get the computer, unlock access, and deal with the command line. This is error-prone and annoying. Having a solution that allows for safe storage of a private key and easy management of subkeys on smartcards would be amazing without the need for an airgapped computer and a command line would be really interesting.
(The signing/verification part can probably be handled today by the keybase tool.)
Okay, that's maybe more specialized. Let's move away from paranoid server builds and go toward something similar that's gotten plenty of companies in trouble: Malicious e-mails. How often are we hearing about some poor employee receiving an e-mail that appears to come from a co-worker that contains a finance document with a trojan? Or maybe just a simple document with a form, instructions, and a link that results in information leaked to some third-party?
If there was a dead-simple way to sign and validate documents over Keybase (and I mean dead-simple, built for people who only know Word and Excel), for use in e-mail and document management, with marketing around "For $XX/user/month, you don't have to worry about getting hacked," I bet plenty of companies would bite.
I don't know what that looks like exactly, but just playing around loosely with some thoughts, it would be interesting (particularly for fully IT-managed systems) to have a Keybase Shield product that would automate much of the signing and verification of documents. It could tie into Word, Excel, etc. via their plugin interface and sign on save, and/or provide a big "Sign this document" widget on the side of the screen that a document can be dropped onto (or a Share action on phones). It'd then own the file associations for these documents, intercepting them when opening via e-mail or file servers, and would validate their signature. A document from the outside world (or one not going through the corporate-mandated signature process) would outright fail to open with an error message and instructions to ask the sender to please sign the document.
(Lots of details to work out there, but if this process could be made simple and mostly automatic, you'd help close a major attack vector that companies are susceptible to today.)
Anyway, it's great hearing your thoughts on how Keybase plans to make money. I've been in the same boat of loving Keybase but being uncertain about where it'll be 5 years from now. We'll keep an eye open for some paid products :)
There's no explicit signing process involved, but that's part of Keybase's value proposition: automatic and transparent public key cryptography.
The value proposition of automatic and transparent public key cryptography is strong, and what I love about Keybase. Just thinking of other ways that can be applied transparently.
(Anyone else with relevant thoughts on what IT needs around encryption, recovery, key backup, etc, please feel free to write me, too)
Actually, in that last one you should probably also offer consultancy to set up the servers securely - both software and physical hardware security. Secure software isn't worth much if the systems it runs on is compromised. Consultancy can be worth a lot of money, if your customers think it's worth it.
I'd start working on offering a paid enterprise solution soon tbf. I'd also tweak your landing page, the blurb is "a new and free security app"; the "new and free" doesn't instill much trust, and the "security app" doesn't really describe what it does. The second phrase tries to explain that "it's Slack" or "it's Dropbox", which I guess is fair, but I'd aim towards distancing yourself and describe it as e.g. "End-to-end encrypted communications and file sharing". What makes Keybase unique? I mean Dropbox has a pretty solid security page (https://www.dropbox.com/business/trust/security/architecture), as does Slack (https://slack.com/security).
IIRC it boils down to a new Merkle root and a self-hosted server instance that uses it. Add snapshot pushing to the blockchain and you've got yourself an independent Keybase instance with a fresh and clean database ready to be filled with employees.
I wonder what the identity proof adding would look like. I guess corporations are not interested in public proofs from Twitter.
> How am I assured [?]
You're not, even if they start making money. Sucks, but true.
> You guys should be taking my money
One way to pay, if you want to help ensure their success & longevity, is to evangelize for them, and get other people hooked on their product. Getting other people hooked on it like you are and seeing the potential and get over the adoption humps... that's valuable! They're not taking money because it raises the barrier to entry, and growth is most important. Pay them by helping them grow.
Without a road to profitability (or at least a road to revenue) even attracting equity is difficult; investors who enter with that knowledge will be looking to exit through acquisition, since that's basically the only way to exit, other than just getting more capital.
Surprisingly, you guys look like a direct clone of the new Bitbucket interface. Its not my favorite (I like github so much better) - but Bitbucket with its inbuilt Pipelines integrations is so much better than Github.
You mean, you have to run git fsck after pulling, since git only checks that you got what you asked for?
Isn't the commit sha1 determined, in part, by the sha1 values of the tree it refers to as well as the sha1 of the parent commit? If you fetch a branch from a compromised remote, all the sha1 values of the commits that were compromised would be different.
tree sha1
parent sha1 of parent I want to attach it to
author some string
committer some string
The commit message
That is, would it think it has the commit because the sha1 hasn't changed, but the tree sha1 has been updated and it would presumably refer to blobs that the client doesn't already have and try to fetch them. Or would it not proceed because it already has the commit?
I’m sure there’s a law with someone’s name that states that. But just in case it hasn’t been claimed yet, I’m proposing that we call it the fuck you law. Because the next time someone comes to me to ask me to fix their trello to zappier to email to google sheets setup they use as a project management tool, I want to be able to say, “Fuck you and there’s a law that says so.”
EDIT: I should emphasize that this model is way more convenient than manually having to remember to push and pull all the time. Now push is only for publishing outside as it should be.
Is it possible to use this on the Keybase mobile app for like note-taking?
I heard this a couple of times and tried to confirm it a while ago, but was unable to. I wasn't able to forge a repository with faulty hashes in it. I also heard plenty of people tell me that there exist public repositories with wrong hashes in them, but when I asked them they never could come up with concrete examples in the wild.
I'm seriously curious about this, can you provide any clonable proof of concept repository with wrong hashes?
I believe Git CAN check the validity of sha1 hashes (I read the source a few years ago and have a very tiny git commit) using git fsck, which I believe kernel.org does nightly. It just doesn't do so automatically with every commit or whatever. But you can set up a test in your server, I believe, if that's important to you, either watching the files, or checking pushes which I believe github does. So that's not the issue.
It's sha-1 collision attacks that are a theoretical issue.
My understanding of the currently known SHA-1 attack is that it requires binary data (hence PDF files for the example) and requires you to control both the original file and the subsequent file. So an attack would have to generate an apparently innocent file and a malicious file both of which have a binary block, insert the innocent file into the repo, and then somehow, most likely outside of a git push given mitigations like github's, replace that innocent file with the malicious file.
Now to your question, checking in the PDF files from the proof of the attack in git doesn't work, because git also adds header info. And generating the files requires ~ $100,000 dollars worth of ec2 time, or the equivalent, so nobody has gone through the trouble of generating files that allow this specifically to prove it for git. Bit it's definitely possible, and cheap enough for a criminal organization or a state agency to do. Just because someone hasn't done it for git specifically shouldn't mean that the attack isn't possible, just that security researchers don't have unlimited funds, and the existing proof, while not specific to git shows the issue generally applies.
Last I saw, the git mailing list was debating sha3-256 and BLAKE vs SHA-256. There's some indication that SHA-256 may get intel HW support, and that may be useful for speed with really really big git repos (like microsoft's apparently). SHA-256 doesn't have an attack on it that's known but unlike ShA3-256 (and I believe BLAKE since it's a stream cipher) SHA-256 is a block cipher, so it's not stateful. That means, while no known attack exists, theoretically if an attack existed you could corrupt a specific block in a similar manner to SHA-1. But SHA-256 has been much more extensively tested for issues while SHA3-256 is newer... it was created ostensibly as a backup in case the current known safe standard of crypto like SHA-256 is attackable.
There are some issues with SHA-256 being used in repos that have signed SHA-1 hashes already, in terms of mapping SHA-256 to SHA-1 hashes without borking the signing. Obviously if you change the underlying structure of signed stuff to store a new hash, it changes the hash.
My personal thought would be to implement SHA-256 and SHA3-256 as options simultaneously, as they are both NIST standards, make SHA-256 the standard so big repos can be as fast as possible.
I am not a crypto expert, or a git expert though, so if I'm wrong, please correct me. Being wrong means I get to learn stuff and that's great!
That second part of the fuller quote makes the first part irrelevant.
Git, sans GPG, does no validation of the given username and email - it is trivial to configure my laptop to stamp commits with hannob@ instead fragmede. All I need to do to frame hannob, then, is write access to a repo that they contribute to.
In the centralized world of github, that's a little bit more tricky, but at larger organizations where large groups (eg, all of eng) simply have write access to the repo(s), if git blame says hannob wrote the commit that stole passwords/money/etc, guess who's getting fired?
With GPG, I'm able to configure git so that commits that actually come from me have a GPG-validated signature. Snarkily, the blog post claims "no one" does this but I do. Given that this feature is known to be infrequently used, I'd believe it if git would accept commits with a bad signature.
It would be nice if I could have an encrypted copy in S3 or Dropbox or somewhere, that presumably maybe git couldn't directly make use of, and would be encrypted and those services couldn't touch either, but that the app could still push/pull changes to.
Certainly, I'd still have an unencrypted view of the contents in any local clones of the repository I may have in the case that I couldn't access keybase storage, but it still seems like there may be useful cases where an encrypted backup is somewhere else in the cloud as well, as a safe failover just in case.
- [spwhitton/git-remote-gcrypt: PGP-encrypted git remotes](https://github.com/spwhitton/git-remote-gcrypt)
I use [Pass](https://www.passwordstore.org/), a password manager, which uses GPG and Git, and I keep an encrypted copy of my Pass Git repo in Dropbox and have that repo copy setup as a remote in all of the local copies of my password repo. So, the contents of the local repos are encrypted, but in the encrypted copy all of the Git data is encrypted too.
Is Keybase Git all hype then? Because the alternatives seem a lot better.
To be honest, I'm not even sure I understand what Keybase _is_.
What, like never? Or just not under specific circumstances?
I sure wouldn't want git to be doing that in every darn operation that traverses the history, like git log.
When receiving packets from another repo though, it would be useful.
If you want an encrypted storage solution with integrated read only access capabilities, I recommend using Tahoe-LAFS. You can probably store a git repository in it just fine.
1. Is there (or will there be) any way to create an encrypted git repo shared between a few users that aren't part of a team? e.g. could I create a repo that belongs to eridius,chris and have us both access it?
2. Can I create a repo that belongs to a subteam?
And on a different note, I want to create a team but the name is currently taken by a user. The user has zero activity (no devices, no proofs, chain is completely empty, literally nothing). Is there any way to recover a name that's being squatted on?
Yep, though it's undocumented and it won't show up in the GUI right now (maybe ever). You can just push/pull directly to repos like "keybase://private/u1,u2,u3/foo" and it will create it on the fly. But we warned, there's currently no way to delete those, and typos in the git URL can cause unintended repos to pop up.
> Can I create a repo that belongs to a subteam?
Yep, should be the same as a regular team.
You can already do that with Gogs.. It's a single binary, uses git, supports accounts, 2 factor, etc. https://gogs.io/ Really useful for small teams that don't want to use github or gitlab.
When the SHA-1 collision was calculated earlier this year, Linus commented on git and SHA-1. No further questions, just sharing it here if you happened not to see it: https://marc.info/?l=git&m=148787047422954
Again, thanks for all the hard work. Best of luck.
There's been talk of making this the default, but it's trivial enough to stick in your .git
By default. But set "git config --global transfer.fsckObjects true" and it will. No need to install anything else just for that.
Btw your product is awesome! Multi platform encrypted team chat that doesn’t even need 4gb of ram :)
And, it really sucks that GitHub does not encrypt data at rest:
--- SNIP from https://help.github.com/articles/github-security ---
We do not encrypt repositories on disk because it would not be any more secure: the website and git back-end would need to decrypt the repositories on demand, slowing down response times. Any user with shell access to the file system would have access to the decryption routine, thus negating any security it provides. Therefore, we focus on making our machines and network as secure as possible.
--- SNIP ---
Encrypted disks are now the norm across various cloud providers, as is HTTPS. The crypto overheads are really low, and their benefits significantly outweigh the risks of leaving clear-text data on disks.
Also, defense-in-depth is always worth pursuing. The claim "it would not be any more secure", is so far from true, it's almost insulting to their target audience.
Keep killin' it, Keybase! Great job!
With Keybase, the data is encrypted on the client, and the keys stay on the client. Assuming the crypto is done right, there is fundamentally no way for Keybase to read the data, and therefore no way for an attacker to get the data by way of compromising Keybase. The only way for an attacker to get the data is by compromising the client machine, which is a very different threat model.
With the model you're proposing for Github, the data would be encrypted for transfer (via HTTPS or SSH), but then it would be immediately decrypted again on the server. Even if it is encrypted again before it's put onto the disk, fundamentally the key lives on the server (and has to in order to provide Github's feature set) and so an attacker who had compromised the machine would simply grab the key before going after the files on disk. The actual additional security you get is really not that significant.
Personally, I appreciate Github's stance on this. There have been a number of "secure" products (see e.g. Lavabit) that have really been snakeoil because they used the approach above. I'll take honesty over false promises any day---at least with the former, I understand my risk and can take steps to mitigate appropriately.
The only thing that at-rest encryption would prevent is someone walking into a datacenter (or wherever the drives are physically stored) and nabbing one. An attacker is much more likely to gain access to a live system, where the data would be readily accessible.
Any bug (or poor security practices) at a cloud provider means that data not encrypted at rest could potentially leak to the next customer who the cloud provider assigns your old storage to. There's still a possibility for a cloud provider to leak data via lousy key management, but not storing unencrypted data greatly reduces the attack surface.
It's not just compromised machines that you have to worry about -- that's what the higher layers of security are for:
It's also:
- poor disk decommissioning (e.g., your staff throws away disks without properly erasing them.) - poor machine management -- machines assigned to one owner, then moved to a new one. - bugs in storage management systems that leak data (e.g., block replicators, etc.)
Also, note that the keys don't have to be on disk. Most cloud providers configure hosts to get keys via PXE boot, for exactly this reason.
To be clear -- I don't disagree with you about thinking about the threat model, and in many cases it's not necessary to do this. But I do think that GitHub is now a very large player in an enterprise market, so I can't let them off so easily. :-)
Why don't more people use gitlab btw?
I ask this because I'm trying to figure out a solution for myself for keeping sensitive personal information and I never thought about storing such documents in a repository. Maybe I am missing something and your use case will open my eyes. Thanks!
Now, if i update one document on computer A, and another document using computer B, i have to sync it to all other devices which is a PITA without git. You get into the situation where you don't know if the version on the USB drive was newer or older than the one on computer B etc, whereas with git all this is available in the version tree and there are nice merge tools available.
I've been planning to do this even for photos, for all the reasons above, but haven't taken the full step yet.
I used to keep the data on Dropbox but switched to a repo because it felt to have better safety against user error. It's not all that hard to accidentally delete or modify a file in a filesystem. Given the commit process it's much harder to do in a repo.
If all you need is a single git clone, and you already have a Keybase account, just do a git clone locally, and use rsync to upload the result to the remote server.
> ~ Anticipated q's ~
> What if we're living in a simulation?
> Keybase offers no guarantees against sophisticated side-channel attacks by higher-level entities.
> YES. IT'S LIKE THE MATRIX BUT INSTEAD OF ROBOTS IT'Z LIZARD PEOPLE.
> THIS ISN'T A QUESTION BUT GOOD POINT. WE R BEGINNING THE MOVE UNDERGROUND.
http://www.pbs.org/wgbh/nova/next/physics/physicists-confirm...
There was a Hacker News post about this a few days ago, likely from a different source, but I can't find it.
Anyone from keybase prepared to comment?
http://ptspts.blogspot.com/2017/10/comparison-of-encrypted-g...
If I missed some of the aspects, please let me know.
... I think I'm in favor of this. I think of the things that those services provide on top of Git should actually be ported or mapped to Git itself. Branches, pull requests, comments, etc... should all be Git objects of some sort.
That's not how I understand refs, they don't even live in the .git/objects hierarchy.
cp .git/refs/heads/master .git/refs/heads/WTFFF
> I guess I don't understand what GitHub/GitLab does that makes branches different from Git itself [in the GP]
The GP is mistaken. Their understanding of objects & refs seems different to how I've seen them refered to in the majority of git literature.
For passing readers: refs (branches and tags) are just git's way of labelling a commit (which are stored as objects). GitLab/GitHub don't do anything special to implement refs: they're standard git refs. They're not different, they're 100% part of git.
GitHub/GitLab do add a lot of extra refs to track things like PR/MRs.
> Branches, pull requests, comments, etc... should all be Git objects of some sort.
Branches can't be objects because you'd need a way to find them with a label, and then why not use the labels directly instead?
PRs and comments can be stored in a repo (as refs and notes), but git doen't have a strongly-opinionated view on the exact workflow you should follow when developing, and thus isn't interested in recommending that people should always use forks & CRs.
I recognize and accept the argument that it might be nice for Git to track merge-requests and issues (hence my link to Fossil SCM)
Note that the commit history doesn't depend on branches: it's just a chain from commit to commits. The tree can exist withou any branch at all. That wouldn't be very useful, but it's still valid. Branches are merely pointers to a commit.
Since it keeps secrets completely outside of git, you don't have to give up the convenience of collaboration tools by client-side encrypting the whole repository, and integration/deployment is simpler than maintaining a separate encrypted secrets repo.
Here's our Show HN from last week for more detail and discussion: https://news.ycombinator.com/item?id=15330757
Currently I add the random person's fork as a remote to inspect/modify their PR branch. Was hoping for some GitHub magic to eliminate this step.
This can be a pretty common setup for some git workflows. Everybody makes a fork and takes / pushes pull requests or branches from their fork to others. The main advantage would be that if you have a lot of branches they don't all have to be on upstream and you don't need to have upstream permissions for everyone to push branches or changes to.
Nonetheless, I can see why my comment raised some confusion.
Should be the epitaph of the current era of computing.
I say tools, because while a library would be cool, I'd understand if it was a binary/application to provide the functionality/user-experience that key base is aiming for.
I know this likely doesn't sound like something key base should be aiming for, but to me, programmers need encryption just as much as users. I'd like to write my libraries/programs with encryption, but I also want to be able to trust it and not fear some inherent vulnerability I'm adding.
To me, Keybase is aiming to solve/reduce these complexities for users, and I'm hoping they also aim to solve it for developers to.
Thanks for all the hard work folks @ Keybase, it's definitely appreciated!
I wouldn't say it's foolproof though. I agree that simpler, higher-level libraries are needed across the board.
Then simply check out that git repo using a file://path/to/repo reference, creating a clone on a local drive out of the encrypted volume.
The encrypted filesystem can then reside on an untrusted server in the cloud.
Ultimately, this is a cleaner solution than the whack-a-mole approach of hacking every application one by one to retrofit it with crypto storage capabilities.
> Why not just make a bare repo in KBFS?
The Keybase filesystem journals changes and syncs them after writes, kind of like Dropbox. Which means you and another team member could be fighting each other and make a conflicted HEAD, where there'd be 2 copies side by side. Similarly, you shouldn't put git repos in Dropbox.
Keybase's git prevents this by locking.
Also: it's nicer to use the Keybase app to discover and manage your teams' repositories.
Also, one unique design choice of Dropbox is to use the underlying file system which means that working out of a Dropbox folder is native speed, even for high intensity IO. Keybase is a lot better than, say, Wuala was, but it's still noticeable.
[1] In prioritized order: camera uploads, viewing and editing plaintext, show photos, playing music and video, uploading to Dropbox from random other iOS apps, and finally selective offline access.
Start kbfsfuse (specify a directory as a mount point); put get-remote-keybase to your $PATH; run keybase git create myrepo; you can stop kbfsfuse now; then this works (after substituting $KEYBASEUSER):
git clone keybase://private/$KEYBASEUSER/myrepoEdit: Just tried and no dice: 'Remote "origin" does not support the LFS locking API.'
The way it works is you identify a file that you don't want to check into source. The cli moves it to a parallel repo, commits the file to the parallel repo, and symlinks the file back to the original location.
From then on, you get all of the normal source control features like local changes, revision history, etc... that you get with every other file in your project. I basically got fed up with "crap what was that value I was using before? Let me dig through my credentials store" or resorting to commenting out old lines just in case I needed to revert.
So far, I've just been keeping those parallel repositories local for lack of an encrypted remote to push to. Definitely checking this out.
https://news.ycombinator.com/item?id=14069674
Versus the data Signal collects:
https://signal.org/bigbrother/eastern-virginia-grand-jury/
Although I agree Wire looks like a much more (visually) polished chat service, it seems like they (Wire) collect more data than is necessary.
https://medium.com/@wireapp/wire-server-code-now-100-open-so...
So you can run your own copy of it, and be in complete control of any information it collects.
* You can take a look at the packets (using e.g. tcpdump). * You can take a look at what the binaries (rsync, ssh vs. keybase and git-remote-keybase) read and write (using e.g. strace). * You can read the source code. * You can read the white papers and other analyses about the crypto used, and decide if you trust it.
The average user probably won't bother with these, because they need time, effort and experience.
If you can imagine a fundamentally better possible way for the average user to verify crypto, please let us know.
$:~/projectes$ git clone keybase:// [uri] Cloning into 'something'... fatal: I don't handle protocol 'keybase'
I'm on an ubuntu machine. What can I do to solve the problem? Keybase version 1.0.34-20171006000413+5fe91ae13
- How could CI/CD be set up? (Is read-only access possible to the repo? Would Keybase work on a Jenkins box? Could a deploy server verify signatures before deploying?)
- Could one set up mirroring to GitHub? How would this work? (I could see the signing without encryption as a value-add)
- What happens in the event of a force push? Could certain users destroy history?
- Could protected branches eventually be added, eg only certain users can push to master?
You could have a deploy/CI user as a "reader" in your team. But we don't yet support hooks or anything (as that implies running arbitrary code on endhosts without their knowledge), so it would have to pull the repo.
> Could one set up mirroring to GitHub? How would this work? (I could see the signing without encryption as a value-add)
You can of course continue to use Github as a regular remote, but you'd lose all the encryption and signing unfortunately.
> - What happens in the event of a force push? Could certain users destroy history?
We do currently allow force pushes. Being able to turn that off on a repo-by-repo basis is something we'll consider in the future, definitely.
> Could protected branches eventually be added, eg only certain users can push to master?
Yes, but again, as with any "server"-side feature, this is complicated by the fact that it has to run on the client itself, and thus isn't really strictly enforceable against modified clients.
As we get more experience with people using this, we will definitely be thinking about how to make it better by adding power features like these. Thanks for the feedback!
> What if my computer is compromised?
> Your work is only as safe as your endpoints, so we can't help you there.
This applies regardless of host or protocol, BTW, and it isn't even specific to computing. (It doesn't matter how many locks you have on your front door if you leave the back door propped open.)
You may also want to look at https://github.com/roddhjav/pass-tomb
>> What are the limits?
> You can have as many repositories as you want, but the total for your personal repositories can't exceed 100GB. Each team also gets 100GB.
Is there anything stopping people from creating team after team just to hoard data in Keybase?
The Git repo itself is completely normal in every other respect, so if you push to Github, everyone can still see the entire repo.
This is a good design as it lets people move repos easily and avoid too much lock-in, but it may (will...) come back to bite people soon, who push things to Github thinking they were "encrypted by Keybase", which is not what's going on.
#1. Host a file on your site
You can host a text file, such as yoursite.com/keybase.txt. This is preferred, if you have a website.
#2. Set a DNS TXT record
Instead of hosting a web page, you can place a keybase proof in your DNS records.
Not necessarily. I'm talking about people who want to remain anonymous (or pseudonymous) and might want to keep as low a public online profile as possible.
It should be possible to augment the existing proofs with the WoT relationships, which could be valuable in a small number of cases.
However, it wouldn't surprise me if more people started using Keybase because of this one blog post, than have ever used PGP's web of trust features.
Not sure I understand.
git clone blah
cd blah
git fsck
What am I missing?
If the former, what are case where this is needed?
Consider a repo containing passwords. It's easy enough to encrypt the files containing the passwords but the names of the files or even the directories in which they're located are also info you might wish to hide, e.g. that you have an account at some-site-you-do-not-want-anyone-to-know-you-visit.com.
Yes, everything is encrypted on your machine locally.
Definitely not just posting this to verify myself.
More precisely, the government will claim that ...
The home page says:
> Keybase is a new and free security app for mobile phones and computers.
ok, so, what does it do?
> For the geeks among us: it's open source and powered by public-key cryptography.
Still have no idea what it does ..
> Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server can't leak your files or be hacked.
ok, so what is it? what does it do?
> [picture that looks like a chat app]
So it's an encrypted chat server?
What is it?
How can you have a homepage for a product that doesn't talk about what the product is and what it does?
Why so obscure? Are you trying to hide something? Is this really a home page for a product aimed at people who care about security?
Compare it to, for example, tarsnap's[0] homepage, which explains exactly what the product does and doesn't leaving you wondering about anything.
> Keybase is for anyone. Imagine a Slack for the whole world, except end-to-end encrypted across all your devices. Or a Team Dropbox where the server can't leak your files or be hacked.
It's not much of a reach to assume familiarity with Slack and Dropbox; the message is clearly that Keybase is those (via Keybase Chat & FS) but encrypted.
For what it's worth, it's also a keyserver, and (now) git remote.
It's not. I think the person who wrote it think it's good marketing, but even that, it is not.
Here, try to see if this makes any sense as a product description:
> FeedHamster is for anyone! Imagine a Yelp that's customized just for you! Or a YouTube feed that only shows you interesting videos that _you_ would like!
> Install FeedHamster now!
Now, can you guess what FeedHamster does? Maybe it curates content? Honestly I have no idea. I just made it up. It doesn't really say anything useful at all, but I think it makes more sense that that description on Keybase's website.
Keybase isn’t charging money to begin with, so “sales pitches” are not their primary concern.
Also, they are marketing to “the masses” with the idea that more people should have secure e2e encrypted communication and collaboration solutions where identity is cryptographically proven.
But if their welcome page started showing diagrams of encryption pathways and key derivation algorithm names with server client relationship diagrams, I guarantee no one besides people in tech will download it.
I still think they need to do better selling the idea to the masses, I in no way think their current front page is sufficient, but I understand that right now they aren’t concentrating on sales pitches.
All of the other features you've mentioned are built on top of that key exchange, and use it to offer encrypted services.
It seems like the last year or two they've really been ramping up ways to actually _use_ those keys though. They do have a chat app, which I've used with coworkers, but only to share stuff we don't want to send over Slack. It seems like at least part of the issue they've got with the homepage is that their "core" product -- hosting a public key for someone -- isn't really very interesting compared to the satellite offerings.
It's a product that's great for some security-oriented developers but hard to sell to others conceptually.
In order to make it appealing and useful to a more general audience, they've added extras which are comparable to Dropbox and Slack, just less featured and more secure.
Which seems a good approach given their constraints.
Fundamentally, at this time your market is the more technically minded people who are going to want something a bit more concrete than "Imagine a Slack...".
This might be exactly what you're looking for :)
I've written a simple wrapper [2] to make it easy to use.
[1] https://support.1password.com/command-line-getting-started/
- https://github.com/spwhitton/git-remote-gcrypt
Pass is a password manager that uses Git (or, rather, can use Git; it's optional) and I use the above-linked helper to configure a common remote repo (that's hosted in Dropbox) for all of my local copies of my password repo.
Welp.
https://www.theregister.co.uk/2017/07/04/gnupg_crypto_librar...
Maybe it only uses the Go crypto libraries?
> All data you push is signed by your device's private key, which never leaves your device.
For the reference git already supports signed pushes (git push --signed): https://github.com/git/git/commit/a85b377d0419a9dfaca8af2320...
From the Keybase FAQ:
> So is this signing my commits?
> No, this is happening at a lower level, (1) to allow encryption, and (2) to ensure no unsigned or unencrypted data makes it in. Intuitively you can think of it as you and your teammates using a cryptographic secure storage layer for your git origin that doesn't really understand git.
> Your commits themselves are untouched from git's perspective, so if you mirror your repository elsewhere, it'll be a regular checkout.
> All data you push is signed by your device's private key, which never leaves your device.
Sorry keybase.... you are not a trustable cloud storage for me.
It feels like betting on your company... I want to bet on your company without feeling dependent on worst case restore scenarios (computer dying while your company dies).
If you’re worried about Keybase disappearing with all your data, doesn’t backing up your computer cover that scenario?
Why not? You're making a bunch of claims about this being bad but you're not providing any reasoning for it.