API-0.core.keybaseapi.com has expired certificate | Hacker News Reader

API-0.core.keybaseapi.com has expired certificate

sslshopper.com

114 pointsStreamBright54 comments

Are there any Keybase team members on here? When Zoom acquired the team they said they would notify us if Keybase was going to be negatively impacted; the outcome based on commit graphs, the project blog updates, etc has made overwhelmingly clear that the project is not receiving updates. Can someone either acknowledge that so I can move on to a new system or give us an update as to what's in the works?

Also, perspective for leadership at Zoom: if you buy an open ecosystem and it subsequently dies then it sends a really terrible message. Please right this somehow.

This is the last blog update: https://keybase.io/blog/keybase-joins-zoom

Not to be overly cynical or patronizing, but everybody should really know better than to trust zoom, or any for-profit company really, on things like this

> When Zoom acquired the team they said they would notify us if Keybase was going to be negatively impacted

I mean, at the time I knew that was a lie.

> Also, perspective for leadership at Zoom: if you buy an open ecosystem and it subsequently dies then it sends a really terrible message.

The venn diagram of people who use strong tools like keybase and people who willingly use Zoom has no overlap.

Keybase was acquired in the wake of lots of negative PR around security (zoom bombing, kids booting teachers, employees snooping on calls, foreign spying, blocking anti-Chinese meetings, etc) and was an attempt to get any talent they could in the door. I am shocked it is still running.

Man, Keybase had so much potential, if it had been opened up as a platform. But it seems from the context that it was an acquisition of the team and the code, not the app.

Honestly, just move now rather than waiting for a response or no response, the result will be the same.

It should have been clear to anyone, plain as day, given Zoom's reputation that Keybase was dead the minute the acquisition was announced.

I shut down my account the same day.

This seems relevant:

https://ourincrediblejourney.tumblr.com/

Pretty sure Keybase is abandonware since Zoom bought them.

Its a shame since I genuinely loved Keybase. I've just not felt the same way about another messaging app. Signal appears to be the safest but since WhatsApp is e2e encrypted and most of my social network is there already I'm stuck with it.

Check out telegram. It surprisingly awesome in so many ways. Ultrafast native client on all platforms, very user friendly, time tested, stable, fully packed with features etc.

I love Telegram, but I want to state it clearly: the default chat scheme isn't end-to-end encrypted, which Keybase is. Therefore, it's not a drop-in replacement.

And also the more obvious difference: Telegram requires a telephone number, Keybase did not.

I don’t compare it to keybase. I compare it to WhatsApp and signal

The UX is better than WhatsApp and Signal but the security is worse. Facebook has your metadata but Telegram has everything

Same. Whatsapp and Signal chats are both E2E encrypted, Telegram is not.

https://wire.com/en/ is what i have used for years. YMMV.

I can't get these annoying people to stop sending me spam email, despite having unsubscribed probably 20 times at least. If they can't be trusted to not flood out email inboxes, they can't be trusted with anything else.

Yeah I switched away from Wire again due to constant notification issues (yes battery saving options are disabled on Android). My session has since timed out and trying to log back in on either mobile or desktop just causes the app to crash.

Also there's no Matrix bridge for Wire compared to Signal.

The multi-account support was nice and is something I'd really love to see in Matrix.

I love the encrypted git and the file system.

Matrix is also a nice choice. E2ee and decentralized.

But with poorly audited clients and metadata retention issues compared to Signal

The overall Element UX is pretty appalling too. It's a good idea in practice, though.

Replies being colored red for years, for no good reason... It really needs more UX/UI research and polish.

The red replies is so weird, agreed. Add not being able to change the notification sound to the list. You can change the sound per-room, but not globally... someone reported this back in 2017 but it's never been fixed. The notification sound gives me a bit of anxiety every time I hear it.

Reasonable guess. Zoom openly admitted they were basically just poaching the team, so it would make sense if they stopped working on Keybase.

If it's really abandoned, it's somewhat surprising it's kept working this long.

It's just sad they couldn't just sell the service itself. After all someone might acquire and maintain it.

Yeah looking at the commit graph for the keybase client shows a pretty obvious acquisition date..

https://github.com/keybase/client/graphs/contributors

That really sucks to see. I liked Keybase a lot but have since abandoned it myself too. Shame.

Wow that’s brutal. Any specific reasons for the exit? Did a key contributor leave? Did the new ownership put it on hold? Did they all just get fired?

Please tell me there is a dramatic exchange of emails lurking behind all this.

Zoom clearly had no security talent.

I'd wager they told all Keybase employees to drop it, there and then and get to work on fixing Zoom and its "reputation".

I wouldn't be remotely surprised if a bunch of them then left.

Really sad to see Keybase atrophy even though I'm happy for the team that got acquired.

I wish they'd just open source the whole thing or donate it to the apache foundation or something.

- Sorry about the outage yesterday. It lasted about 1 hour but service was promptly restored.

- As Zoom employees, our primary objective is now to bring the technology at play in Keybase to Zoom products.

- We are still making regular updates to Keybase. These updates consist primarily of bugfixes, security fixes, performance improvements and patches and updates to third party libraries. For instance, the app is currently undergoing a major rewrite to be compatible with recent versions of React and React Native. We are not currently pursuing any major new features. The paper trail for these updates is visible for all to see here: https://github.com/keybase/client/tags

- The current plan -- which can be inferred from our ongoing maintenance to the product -- is to keep Keybase running in a performant, usable, free, E2EE, high-security form for the foreseeable future. Should this plan change, we promise to give as much advance notice as possible.

Thank you! I still use Keybase as my main messenger and would be sad if it went away.

Suppose you only want a replacement for the key management part of keybase, what is there to be recommended? I know of https://keys.pub/ and https://keyoxide.org/ but the former (from someone ex-keybase) has no recent activity and a "not audited" warning, which at least is good to see.

It's only a matter of time for Keybase. Sad, because we've been using it for work communications since the very beginning... I remember talking to colleagues back in the day saying basically "I love Keybase, but I'm kind of nervous if they don't have a plan to make money". Sure enough: acquihire.

For the identity verification part of Keybase - but decentralised - Keyoxide may be of interest: https://keyoxide.org/

I found the "What is Keyoxide?" page a useful explanation that was missing from the homepage: https://docs.keyoxide.org/getting-started/what-is-keyoxide/

I never found the identity/distributed-account thing on keybase useful, as I explicitly DO NOT want my accounts linked, but if that's your thing, definitely worth checking out.

> I never found the identity/distributed-account thing on keybase useful, as I explicitly DO NOT want my accounts linked, but if that's your thing, definitely worth checking out.

The funny thing is that is the only reason I wanted to use Keybase and what I found most useful was that I DO want my accounts linked (at least ones with related identities) so that it is easier to verify my identity across platforms in a still-pseudonymous but user friendly way.

I used to be in a position where it mattered more but it's still nice to have.

Looks like a new cert was issued today. App is working fine for me

Hmm, valid now but with a self-signed cert. Was the original self-signed?

Yes, this has always been the case. The root CA is embedded in the Keybase client: https://github.com/keybase/client/blob/master/go/libkb/ca.go

This provides a way to add some protection against a polluted trusted CA store.

Thanks!

I only started using Keybase as a useful tool for working with Hashicorp Vault in testing but have found some other features like encrypted Git and synchronisation of identity/PGP to be useful.

Does anyone know if there any other tools providing similar or partly similar functionality? Even something self hosted or a combination of complimentary open source apps would suffice.

I’m less concerned about the chat functionality.

Time to move to Matrix? There is e2e messaging there.

Keybase is fairly small, easily audited, and does few things well. Matrix is enormous, poorly audited (and difficult to audit due to the insane overcomplexity), has only a few clients with very bad UX (and unlikely to get a lot more clients due to the overcomplexity), etc. Matrix has its place but it's not a reasonable Keybase alternative.

This is not true. We just got a new independent audit of Matrix’s e2ee (due to be released in a few weeks), and has a tonne of clients with new ones popping up every week. They all have different UX, but some are very simple - both in terms of auditable code, and in terms of UX. Not all the clients are a drop in replacement for keybase, but some of them certainly are on the right track.

Your tonne is different from my tonne I guess — and that's fine. I stand by what I said.

Matrix only very recently got reasonable tools to organize channels (Spaces and they're still definitely not as good), but it still doesn't have Git or file shares.

Fileshares are coming. No plans for git yet though.

Spaces should be much better than Keybase’s channel organisatioon though - what’s missing?

> Spaces should be much better than Keybase’s channel organisatioon though - what’s missing?

The UI/UX and permission system mostly.

Keybase shows each "Space" as a separate (but compactly(!) arranged) section in the main view. It's very easy to see what "Spaces" have had activity. Quite a lot like IRC or Discord in that aspect.

From the perspective of permissions, I can create a tree-shaped structure of "Spaces" and channels. People at the root level can traverse upwards, but people above can't access everything below. It's also very easy to say "This channel in this space is for announcements, only admins (a group of people) can post", like actually a clean neat UI.

Observing network errors when attempting to send messages within Keybase.

Anybody know a good replacement (bot friendly) for keybase chat?

Matrix?

Here is example code for e2ee-capable bot using the matrix-js-sdk library: https://gitlab.com/aleixq/matrix-js-sdk-bot-template

It seems they fixed it.

Reply on news.ycombinator.com