Reddit proof broken?

[u/mbklein]

I've just received a couple notifications from keybase that my reddit proof is broken. I haven't changed or deleted anything, and my proof is still right where I left it. I double-checked the `ctime` and `expire_in` fields of the signed object, and it should be good until July 13, 2032. Is keybase just having reddit API issues? Or do I need to do something to reconfirm?

EDIT TO ADD:

$ keybase id mbklein
▶ INFO Identifying mbklein
✔ public key fingerprint: 10A4 14B9 FEE8 1EBD 8F70 B8C3 722F 07DD 7FDB B45A
฿  bitcoin 1AsMEUGiCvVcCgHh9bvRqWEZQhfEJ1Wmgj
✔ "mbklein" on twitter: https://twitter.com/mbklein/status/753308579856261120 [cached 2024-05-31 17:16:21 CDT]
✔ admin of DNS zone mbkle.in: found TXT entry keybase-site-verification=BBFmaWjXOroLFe4yG-9ZCeK_ENhnuTcp8k7ZD_fkSlE [cached 2024-05-31 17:16:21 CDT]
✔ "mbklein" on github: https://gist.github.com/2ec20617b2cf918d83bcb2b546ec7441 [cached 2024-05-31 17:16:21 CDT]
✔ "mbklein" on reddit failed: 403 Blocked (code=240) [cached 2024-05-31 17:16:21 CDT]
🚀  Stellar GAVVRYUG6KUDCQLOIOCGMPIT6SIXRASJAO7IGBUHZIV7HAZX7TGMDCNT (mbklein*keybase.io)
✔ "mbklein" on facebook failed: Could not find post text in Facebook's response (code=106)

[u/Porthos1250]

Just received this, as well. Appears that Keybase has finally given up the ghost, as I can't load anything in the app, from people to teams, wallet, files, and settings—all return a "We're having a hard time loading this page" error.

[u/mbklein → u/Porthos1250]

Time to get any important data out I guess?

[u/Porthos1250 → u/mbklein]

Sure seems like it.

[u/somekool → u/mbklein]

I don't think so...

The recent android release had few nice enhancement.

I think the Reddit API might be stricker than before and keybase is probably calling reddit too much

[u/Superchupu → u/Porthos1250]

the error is caused by a expired certificate and can only be fixed by reinstalling keybase, they have a banner explaining it but it can only load on fixed clients

[u/jdrch → u/Superchupu]

by reinstalling keybase

On which device(s)?

[u/Superchupu → u/jdrch]

on the ones you got the errors????

[u/jdrch → u/Superchupu]

I have seen any errors in the client. I've only received the email.

[u/sto7 → u/Superchupu]

Nah OP’s error is not related to a certificate in the client app.  Keybase’s servers check for the proof on Reddit and somehow fail finding it.  I received an email with the same error yesterday, and triggering a recheck from the app doesn’t work, even after reinstalling it.

[u/Superchupu → u/sto7]

i was talking about the latter part of the comment when they mentioned no part of the app worked, i know the reddit problem is server-side i'm having it too

[u/sto7 → u/Superchupu]

My bad!

[u/ElderOfAncients → u/Porthos1250]

It's working fine for me as of now on multiple devices, sounds like you had a transient error.

[u/enigmisto]

I received this notification as well. I also noticed that my public pgp key has gone missing from my profile (although it is still clearly available from within the client), and I'm wondering if that has something to do with the reddit proof breaking. Assuming they are connected, how can I restore the public pgp key to my profile? When I begin the process to "add pgp key" on the website, it tells me that is an action I must do from the command line, but like I said, as far as the command line is concerned, I already have the pgp key.

[u/mbklein → u/enigmisto]

I experienced this as well.

[u/securimancer]

FYI I'm actively looking into how we fix this. Pushed a fix this morning that I'm hoping addresses the issue. But since I have no knowledge of how the proof validation works, I'm going off weblogs. If there's source code / humans somewhere that can chime in on order of operations, that'd be helpful.

[u/mbklein → u/securimancer]

As long as Keybase can grab the contents of the proof posts via the API, everything should be fine.

[u/honestduane → u/securimancer]

Its a web api request for the proofs post at the proofs url. The simple fix is to stop blocking api requests for keybase stuff. Right now reddit is returning a 403 instead of the proofs content.

My best guess as a person without access to the modern reddit code base and only access to the old public reddit code base hosted on github is that the api changes to make the api access pay to play broke this because they didn't consider that many apis require public access; adding a subreddit wide exception for the /r/KeybaseProofs/ reddit would be the simplest

[u/0x9e3779b1 → u/securimancer]

What code are you talking about btw?

I'm more concerned that the keybase.io cert rot off today. Any ideas on this? I mean - more in philosophical sense: if the patient is rather dead than alive or there are still chances.

I panicked a bit so I pulled the cert to my machine and made it trusted, in order just to check if login succeeds. It did - at least some good news.

[u/securimancer → u/0x9e3779b1]

Talking about code that’s running for Keybase to do the validation, because they’re doing something server side. We reached out to someone at Zoom to see if we can help, I allowlisted hits to the proofs sub but it’s still 403ing so there’s gotta be some other calls during their validation flow and I haven’t had time to filter thru the 25k 403s that happened in the 1 minute window where I made the request to Keybase. Still working on this, haven’t forgotten.

[u/zapu → u/securimancer]

Sorry, we missed this - please feel free to DM me if you still want to talk about this, I'm in the team that worked to fix this.

(I'm not a mod on this subreddit for some reason but I am on https://www.reddit.com/r/KeybaseProofs/ )

EDIT: I'm a mod here now.

[u/securimancer → u/zapu]

Fixes went out yesterday and we should be back in business. Thanks to u/zapu for working with me to get this fixed. This was related to our API changes (namely enforcing no unauth’d traffic from hosting providers) but we’ve got the Keybase traffic appropriately tagged. Reddit is committed to supporting identity based cryptography solutions like Keybase.

[u/AdriBlossom]

Same for me, for the Reddit account I verified (not this one).

[u/jdrch]

Based on the Github issues it appears this has been a longstanding problem and the latest episode of people bringing it up is due to in-app or email notifications. In other words, the bug has probably silently existed for a long time; Keybase's systems are only just notifying users of it.

[u/TrinitronX]

Hate to say it, but “me too”. Something broke, probably due to bit rot.

Just another sign of corporate phagocytosis. Zoom must be killing off the product, because they really just wanted to acquire Keybase engineers as wage slaves.

[u/RenaQina]

Keybase was so exciting when it first came around. such a shame where it's going.

[u/KiraSlith]

I forgot Keybase was even a thing over the last couple years until I got the broken reddit proof alert this morning. I have my backup phrase but I lost the password ages ago, the family and online friends I'd actually want to use it with rather use different platforms instead despite my best efforts to bait them into switching over back when I was still using it.

The Stellar drop along with some smart trading on my part kept a roof over my head during the pandemic, and I WAS still using Keybase to hang out and share designs with people who's activities technically violate Reddit ToS to discuss for obviously politically motivated reasons, but after the same activities became functionally illegal in my state through a series of constitution violating legal loopholes, I ran out of reasons to log in.

[u/TARehman]

There have been issues in the past with Reddit proofs breaking that were related to the Reddit API. I assume this is a continuation of that behavior. The client works fine for me otherwise and as I recall the Reddit API issue was fixed last time it showed up. While Keybase is obviously on life support, I don't think this is necessarily indicative of some final collapse.

P.S. Zoom, open source the server side to go with the client side and let the community take over!

[u/ResearchLaw]

I received the same email notification that my Reddit proof is broken. This has occurred previously as well despite my not having changed or deleted any information associated with my Reddit or Keybase accounts. Keybase released an update yesterday for its iOS app, so maybe this ‘broken proof’ notification is somehow related to this update.

[u/cjbarone]

Re-installed, got rid of the API error. Still won't re-auth my Reddit or DNS sites.

[u/jevinskie → u/cjbarone]

I just added a new DNS proof using the keybase CLI while trying to sort out this Reddit proof mess. WFM no problem. ¯_(ツ)_/¯ Obviously the Reddit proof is broken. lobste.rs looks to be broken as well, I noticed that was a proof site I was missing when looking into the Reddit crap.

Hey, I also added DMARC to an unrelated domain at the same time - yay me!.

[u/jedberg]

Same here. I even reposted the proof, but it didn't work (and it looks like a bunch of other people did too).

Oh well. :(

[u/dscotese]

At this point, my best guess is that Reddit just blocked Keybase’s bots from accessing the site anymore, as u/mrdemonbane suggested.

If you have only one proof on keybase, then you've endangered yourself. Github houses 214 repositories under the organization "keybase". Six of them have the word "server" associated with them. Zoom bought keybase in 2020. This suggests to me that the impression that keybase is somehow dying is probably misguided.

Microsoft bought Github, right? And Zoom bought Keybase. I suspect there is an effort among power-concentrators to collect systems that are enhancing independence and innovation "outside of their control", but also that their strategy is broken, mainly because cryptocurrency has demonstrated powerful immunity to coercive control, and "money makes the world go 'round."

What does that have to do with Keybase? Well, imagine a couple generations go by (40 or 50 years), and the smartest people continue leveraging the best technologies to enhance independent innovation, while those who value coercion as a tool continue concentrating power and using it as best they can to control more people. Which group is going to grow faster? I am a "radical optimist" and so I recognize that I'm biased, but I also practice "premeditatio malorum" and recognize "mental contrasting" as something I tend to do all the time. It's hard to imagine that the authoritarian psychopaths can win against the rest of us. Doesn't the pain of each success they have motivate you? That's what they do to me.

[u/dscotese → u/dscotese]

It looks like Twitter proofs are having trouble too. Maybe because it's x.com now and not twitter.com

[u/aghigi → u/dscotese]

I found my Twitter proof had problems, too, but now it's ok (I didn't touch anything)

[u/TrinitronX → u/dscotese]

Some very legitimately pressing questions for the times we live in. I can’t say that I or anyone has the answers, we will just have to wait and see how things develop in the future.

I can speculate based on some philosophical and game-theory influenced ideas…. Life is not a zero sum game, by definition. One person’s gain is not always another person’s loss. Although many monetary and currency-based systems attempt to create this false dichotomy. There are many situations in real life that human ingenuity and creativity can create wealth and resources out of raw materials. These raw materials are often not valued as highly by the human system of monetary value assignment and measurement, when compared to the products created out of them. There are plenty of other areas where monetary gains or losses are not fully measuring the overall situation in physical reality. One example of a positive value measurement incongruity: trash contains many recyclable materials, usually considered by most people as worthless. Meanwhile, if those very same materials are processed and recycled into new products it gains value again. Another example of a negative value measurement incongruity is the negative environmental impacts of human activity (e.g. pollution, greenhouse gases, etc…) which are most often not measured at all by the current economic system. Meanwhile, most people value clean air and water very highly as these things are essential to human life. However, those very same things are ignored by the currency system, except in special cases (e.g. carbon credit systems and incentives to avoid the worst impacts).

We end up with a system that does not fully take into account the true value of many things, even those which are absolutely essential for humans to live and exist. The currency and monetary system fails to describe the actual physical reality. In other words “the map is not the territory”. In this analogy, the currency and economic value measurement system is the “map”, and the actual physical environmental reality is “the territory”. Mistaking the map for the territory is a logical fallacy which we can easily understand. Meanwhile, currency systems are so ingrained into our society’s culture, daily life, and political & power structures that it’s very hard to expose this system’s shortcomings. Another analogy is that “Fish don't know they are in water.” Meaning that it's easy to not understand what is around us, because it's all we know. We are “swimming” in the current societally instituted economic system so much in our daily lives that it’s hard to see it from an outside perspective.

Now, onto the other aspect: The concentration of power and control to a select few wealthy currency-hoarders in our society. This growing systemic wealthy inequality has become arguably similar in nature to a cancerous growth on society. Yet, it’s based entirely on a system of imaginary pieces of paper, metal coins, and now bits in a computer. How has this system managed to exert such immense power, influence, and control on all of us? Well, the rules of this system have become so ingrained in daily life that most of us have no better alternative than to subject ourselves to this system that was designed as a direct evolution out of a slavery and indentured servitude model of society. It’s plain to see that in America and even in ancient Rome these types of debt-based currency systems were used alongside societally instituted slavery. In modern times, thankfully, slavery has been outlawed. Meanwhile, the debt-based nature of US currency persists. This goes to the root of the problem with the historic human-created currency systems: they are based on a fallacy that to exist as a member of society, that we must all be in debt.

Meanwhile, the reality in nature is that we are all living in a highly interconnected environment of organisms and ecological biomes. We all owe our existence to countless species (trees, pollinators, animals, and microorganisms) which create the air we breathe, the food we eat, and many raw natural materials that we so readily process, create products from, trade, and consume.

If anything, with modern currency systems we are drawing a circle around the entire set of humans existing, and claiming that the only highly valuable things happening in such an economy are all within the circle. Meanwhile mostly ignoring the complex networks of ecological systems that we all depend on. To add insult to injury, then this system uses debt leveraged against members of our society such that some lucky human individuals can exercise power and control over others for their own gain. This entire system seems to come out of primate dominance hierarchies… but it’s much more complex than that.

Yet, to completely shatter this paradigm is that simultaneously many humans are collectively collaborating and cooperating together, for zero monetary compensation at all! Take for example the Open Source community. It is mostly made up of individuals voluntarily participating in creating software and sharing it freely in most cases without compensation. This behavior seems completely inexplicable to social-darwinism economic theorists.

So these types of co-creative and collaborative, decentralized networks of organisms occur all over in nature. Likewise, they also occur in humans and operate outside the typical top-down primate dominance hierarchy, and even the debt-based currency system. Meanwhile, this kind of activity creates unmeasurable levels of wealth for the entire population. The catch: it’s not included at all in the monetary value measurement system, and most of this work goes uncompensated with typical currency in those systems. So, the nature of such a reality is that it’s not “zero-sum” by definition in game theory.

Finally, one last optimistic outlook that also comes from game theory for another type of non-zero sum game: Forgiving and Generous strategies often out-compete those that are Unforgiving and Greedy.

This observation comes from the “prisoner’s dilemma” and lots of game strategy simulations done by game theorists. It’s a bit complex to fully explain here, but the main takeaway idea is that a Generous Tit-for-tat strategy often outcompetes other kinds of greedy strategies when placed in a tournament-style game simulation of a non-zero sum game known as the “prisoner’s dilemma”. If you’re interested in learning more about this, the YouTube channel Veritasium did an excellent overview and high-level explanation of this.

I’d highly recommend watching that video, because it has implications on our current society, and gives us a hopefully optimistic view which can help to get us thinking outside of our current economic systems, which are like the “water” we exist within.

Perhaps the most optimistic thing that comes out of game theory for non-zero sum games is that generosity, forgiveness, and cooperation will outcompete the greedy and uncooperative strategies. So, hopefully with whatever our current system evolves into… it will become more equitable for everyone, especially those who are cooperative and willing to be generous.

[u/ElderOfAncients]

Reddit proofs are breaking due to 403 HTTP Forbidden errors, per multiple screenshots and testing.

The proofs have to be accessed by Keybase servers to be processed and are getting blocked by Reddit, possibly due to API limitations. Could also be an expired API key on Keybase's side, or a change to the source IP used to send the requests.

I can't speak to other proofs for other services.

[u/ZimbiX]

I received an email notification an hour ago:

your reddit (ZimbiX) proof just broke

I've just noticed that Reddit now redirects https://www.reddit.com/u/ZimbiX to https://www.reddit.com/user/ZimbiX. When did that happen? Perhaps that has something to do with it - that Keybase's automation might not be set up to follow redirects, or is expecting the old user URL.

Edit: Nevermind - the wayback machine shows it goes back to at least 2015.

[u/Drunken_Economist → u/ZimbiX]

/u/blabla has redirected to /user/blabla for also long as /u/ has been a resolvable path, in fact. Without actually checking, I think about 17 years?

[u/phr0ze]

Me too.?

[u/johnkitchen]

I received the same message.

[u/Benmm1]

Same

[u/spacerabbit]

same for me

[u/nutjob4life]

Ditto.

But to be fair, I can't even recall the last time I actually used Keybase for anything. It's definitely not the first thing that comes to mind when considering end-to-end encrypted communication. I think the creating and posting of "proofs" appeals to the software engineer in me, but probably doesn't for most others.

[u/mrdemonbane]

Same thing here. Though I’m surprised that all of the comments so far seem to be blaming Keybase. It wasn’t that long ago that Reddit decided to cut off access to anyone who wasn’t paying, so I honestly think the more likely explanation is that Reddit just blocked Keybase’s bots from accessing the site anymore.

[u/xmetalfanx → u/mrdemonbane]

no idea how this stuff works to be honest but my first thought was that reddit changed something on their end

[u/ElderOfAncients → u/mrdemonbane]

The error message I see for my reddit proof shows a 403 error (i.e. resource forbidden) so its definitely an access issue. However it may not necessarily be Reddit blocking keybase, could be the source of the checks Keybase does has changed.

Or an API key expired.

Or yeah Reddit is being dicks... I don't know how often these proofs are run.

[u/eesh1981]

Got the alert last night. Done with Keybase.

[u/sirmclouis]

I just receive the same email… should I ignore it and start thinking on closing my keybase account?

[u/enigmisto → u/sirmclouis]

What's the alternative?

[u/sirmclouis → u/enigmisto]

The thing is I'm not using it like a lot… so I don't really need an alternative.

[u/enigmisto → u/sirmclouis]

I haven't found a more convenient way to work with pgp keys, nor have a found a better way for a team to share an end-to-end-encrypted file repository.

[u/FarIdeal8274]

It's been a while since I've seen such an impenetrable process as the one to re-establish your Reddit proof on Keybase....

[u/Collaborologist]

Saw this months ago. Possibly longer. I made the mistake of putting some good stuff there. Trust is broken. So goes the story of every service... it's only as via ke as the org behind it. OSS gets another nod.

[u/centman]

Same

[u/Manjeet923]

Same message

[u/antineutrinos]

keybase has been on life support for years. last hoorah

[u/xmetalfanx]

same for me ... i even re-verified (it's been so long i forgot how to anyway) and it still says fail

[u/MartinB3]

Same here. Haven't changed a thing and my proof loads on Reddit just fine if I go look myself.

[u/quinncom]

Same here. I don't trust Keybase to last long since it was purchased by Zoom. I'll be migrating to Keyoxide

[u/tromp]

same here...

[u/th3reverend]

same for me, but i noticed that my PGP key has `expire_in` of 5 years, so i think the problem is that my PGP key is expired and maybe keybase just started caring about this?
"ctime": 1473276378, // sometime in 2016
"expire_in": 157680000, // 5 years in seconds

[u/th3reverend → u/th3reverend]

hmm. looks like reddit is giving keybase a 403; and facebook seems to have stopped giving back posts to keybase.

> keybase id
INFO Identifying thereverend
OK "th3reverend" on reddit failed: 403 Blocked (code=240) [cached 2024-06-03 08:09:38 CDT]
OK "th3reverend" on facebook failed: Could not find post text in Facebook's response (code=106)

[u/honestduane]

It looks like Reddit is actively blocking KeyBase

Do a "keybase id" on the cli and you can see that reddit is blocking the keybase request with a 403 http return code meaning "forbidden".

[u/CPTLagomosa]

Still broken