Hacker News Reader

Comment by verigit | Hacker News Reader

EasyGit data are encrypted by Apple. So it is on par with using KeyBase or GitHub. I give you that it is not the same as rolling your own crypto, but I was replying to a comment about KeyBase.

View on HN

Wow, sir, you are presenting yourself as a little bit clueless. Keybase's whole shtick is thorough end-to-end encryption on all of their products. They're not "rolling their own crypto". They use established, proven cryptography to share keys between your devices without ever having access to your private keys themselves.

Apple, on the other hand, can see everything you upload to iCloud Drive, iCloud Photos etc. Don't believe their marketing, they only do e2e on the Keychain and Messages - and even then the clients have no way of making sure the recipient's key they received from Apple actually matches their private key. So Apple could fool both sides, give them keys generated by Apple and decrypt everything on their servers when requested by authorities like fucking China (a.k.a. MITM).

Sorry, I was referring to the S3+GPG solution. However as far as I know the Keybase client is closed source, so everything you say also applies to them.

The keybase client is open source: https://github.com/keybase/client

GPG is designed to be used by end users. It's a bit cumbersome, but you don't have to implement any algorithms, which is what I assume is meant by 'rolling your own crypto'.

That E2E encryption sure must be easy when you just handwave away key distribution. At least that's still not as bad as when FileVault discarded the user's password hint and instead used the plaintext password itself as the hint.

Don't know anything about keybase, can keybase see the data in your encrypted git repos?

No, they are end to end encrypted.

https://keybase.io/blog/encrypted-git-for-everyone

Reply on news.ycombinator.com