Hacker News Reader

Comment by mikorym | Hacker News Reader

It is funny that Zoom was one of the companies that I flagged in my head as the worst (or rather, most dangerous) up-and-coming tech company and I considered Keybase one of the most promising up-and-coming tech companies.

Keybase solves a (to me) nontrivial problem: How to bring private keys into social media. Just a silly example: You don't use the same private-public key exchange in Whatsapp as you would use for your emails, or to sign your packages. It's a bit of the now infamous Dropbox situation: Most people can sign things with private keys and properly keep track of it, but they don't get around to doing it. It's only critical cases where the use is common (like signing packages). It took a long time even for HTTPS to become standard practise, though I guess the situation with your browser is a bit different.

View on HN

> Zoom was one of the companies that I flagged in my head as the worst [...] Keybase one of the most promising

Hear hear. It really is an absurd world we live in, and I had a good chuckle about that - just before I deleted my Keybase account.

Can you elaborate on what concerns you so much that it warrants deleting your account right upon hearing the news?

Zoom is, or was, collecting a list of running applications on machines. Keybase requires that you run it on multiple devices for security. It would be reasonable to expect that Zoom would love to embed such data harvesting in the Keybase client.

Do you have a reference for this? Were they confirmed to be sending the info to the server? I would note that it wouldn't be uncommon for a program like zoom to have the relevant api calls in it to allow the user share a specific app with the conference call.

Yes. https://www.howtogeek.com/664624/does-zoom-really-monitor-wh...

This article does not say if Zoom tracks the other running application in your PC. It just detects whether the Zoom application is in focus.

I wrote Zoom off last year after the local webserver nonsense. Any company that can convince itself that is a good idea doesn't deserve my business. There's no path to redemption. Game over.

In the post Covid world I was forced to compromise a bit and I will join a Zoom call in a browser (when it works) or install the app on my phone if I have to. I trust iOS to not get totally owned by a rogue app more than anything else I have available. Although recently that's not an entirely safe bet either.

Keybase was not critical to my daily life so it will not hurt to get rid of it. It's about risk management. There are no upsides to Zoom and almost no upsides to Keybase (for me). With the growing list of downsides it's an easy choice to make.

It could be argued that acquiring a whole security-focused company is a signal they’re seriously reconsidering their approach to security and deserve a benefit of the doubt.

They also lied about having end-to-end encryption. The awful security practices could be chalked up to incompetence but the fact that they lied has taken it too far, in my opinion. I too have deleted by Keybase account because of this.

Sure, you could argue that. It would be a terrible argument though.

Why do I owe a commercial enterprise anything? They demonstrated repeatedly they cannot be trusted. In obvious and extreme fashion.

The fact that Keybase agreed to this tells me a lot more about Keybase than it does about Zoom.

I too deleted my keybase account right after reading this article.

Yes, this was exactly how I mentally categorized these two companies as well.

My first reaction was: it can't be that keybase can it? Huh, well maybe I'd sell my principles for that much money too, oh well.

Maybe some keybase employee will end up being a whistleblower sometime soon though.

Well, they are pitching this as bringing secure stuff to the masses. So it's arguably not all that inconsistent with what Chris etc have been saying about Keybase.

Honestly if at this point Zoom hasn't lost all credibility in your eyes I don't know what to say.

Zoom already has end to end encryption according to some of their other press releases and public statements (we know they don't), so why on earth would you believe this one?

I guess that it's because I liked Chris and his team, and so I'm trying to be generous.

Have a try of Maskbook.com , ran by our team. I believed this actually solve this problem in a more elegant way.

I thought what I’d do was, I’d pretend I was one of those deaf-mutes.

I don't quite get the purpose though, why would I post something in public only for a group of people to be able to read it? Why not post it in a private chat then (encrypted, naturally)?

Reply on news.ycombinator.com