Comment by sneak | Hacker News Reader

Comment by sneak | Hacker News Reader

Parent Full thread

So, the company that got bribed by a shitcoin promoter to backdoor the keybase app so it can abuse your secret keybase identity keys to place permanent, non-removable shitcoin ads on your profile[1] (and then immediately denied that it was a backdoor and also lied about implementing the ability for users to remove the ads keybase got paid to place[2]) is now joining up with the company that has shipped sketchy backdoored client software[3], consistently lied about having end to end encryption (and even doubled down on their lies when confronted about it!)[4] and delivers their encryption keys from generation servers in China[5].

I'm sure the result of this will be lots of good and secure trustworthy software that I'll be eager to install on my computer. It's totally legitimate and accurate that people are reporting today that this acquisition will bring real end to end encryption to Zoom as if buying a company causes software to spontaneously manifest out of the ether with zero delay. Don't worry, everyone: Zoom is secure now because they wrote a check!

What is it with cryptographic charlatans these days?

[1]: https://sneak.berlin/20190929/keybase-backdoor/

[2]: https://news.ycombinator.com/item?id=21109530

[3]: https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

[4]: https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-...

[5]: https://www.forbes.com/sites/thomasbrewster/2020/04/03/warni...

Please don't post in the flamewar style to HN. We're here for curious conversation, not to smite enemies, snark, score rhetorical points, and whatnot.

Also, if you ratchet rhetoric up to this level of indignation, you detract from your own credibility, so it's not in your interest.

https://news.ycombinator.com/newsguidelines.html

My apologies; I thought it was on this side of the line, if a bit sarcastic. I do my best to comply with the guidelines and keep it on topic here.

Please delete/kill the comment, it’s actually irrelevant because their old product is probably toast now (as is implied in TFA). My delete button timer has expired.

After reading part of [1], I have no idea how you draw the conclusions you do.

I was playing around with a bunch of different crypto currencies when Keybase did the airdrop with Stellar. At every point in the process, it was opt in. Then I received ~$60 and that was it.

It seems your article was going for sensationalism and was highly disputed by all commenters on HN, not covered up by some capital driven conspiracy.

I'm pretty sure I ended up receiving a load of XLM without opting in at all.

You're wrong. There is an opt-in for wallet key generation. The opt-in does not say that when you opt-in to generate a wallet keypair, it will also do a second operation and use your existing keybase identity keys to sign an attestation that will then be permanently affixed to your profile.

The text alludes to that being possible, but it doesn't tell you it's going to actually do that, or that it will then be impossible to remove the ad from your profile after you do.

The specific opt-in consent text matters. It says a thing, you click ok, but then it does that thing but also a second thing.

Ultimately this doesn't matter though, because keybase is toast now.

As an average user, can you explain where I’m “supposed” to be upset according to your interpretation of their alleged deception?

Your writing comes off quite accusatory but is also full of technical jargon that I can’t parse so I’ll naturally side with the majority. That’s not saying you’re wrong, but I’m sitting in a camp where I have 60 bucks and don’t feel slighted by their practice in the least.

From your second link a commenter actually steps through the flow: https://news.ycombinator.com/item?id=21116981

It seems pretty clear from that description that the user consents to signing...

I think it’s annoying to see wallet and chat when all I really cared about was a discoverable public key, but it doesn’t appear to be a backdoor signing method.

The guy you're replying to is the one who wrote the misleading blogpost that was (rightfully flagged) in link [2]. I think it's likely that if he's still grinding this axe 7 months after a very reasonable explanation was given by Keybase, he's not going to change his mind now.

No, the consent modal is for generation of the wallet keys. It says nothing about the fact that if you agree to make a wallet, it will then use your keybase identity keys (different keys, not the shitcoin keys you consented to generate) to sign the attestation and permanently affix the resulting ad for Stellar to your profile.

1: it wasn't a backdoor 2: it wasn't a backdoor

RON HOWARD VOICE OVER: It was a backdoor.

Reply on news.ycombinator.com