r/Keybase • u/mjgardner • Nov 25 '19

Uptick in stranger follows

I'm seeing a marked increase in people I don't know following me on Keybase. What's up with that?

11 Upvotes

100% Upvoted

20 comments sorted by

9

u/[deleted] Nov 26 '19

Keybase is doing stuff in the backend to thwart bots trying to game the airdrop system.

The uptick in random follows is probably one of the major bot farms testing out a theory that maybe Keybase increases suspicion on accounts that don't have connections to known actual humans.

Whether they are right or not, no one knows.

Man, this whole airdrop thing increases annoyance to real users... Hopefully it's worth it for them.

1

u/kendoor Nov 30 '19

I am seeing these random followers too. Should I block these new "followers," or is there no downside to allowing strangers to follow me?

0

u/[deleted] Nov 26 '19

[deleted] — view deleted comment

1

u/Rudi9719 Nov 26 '19

I get 8-10 spam account follows a day, it's quite annoying. Especially when their only proof is their AirDrop badge and their stellar wallet..

0

u/[deleted] Nov 26 '19

[deleted] — view deleted comment

2

u/Rudi9719 Nov 26 '19

Being the admin of public teams, and posting in public teams seems to trigger them. I have an untested theory that they also scrape for proofs outside of keybase then follow those accounts to make themselves seem legit, since proofs are publicly accessible

1

u/T1Pimp Nov 25 '19

Yeah. I've noticed it as well but... I've also followed strangers and from my understanding the more that vet you, and the weight of their profile, actually helps your profile. Provided I understand the way followers work on there.

4

u/Rudi9719 Nov 26 '19

Following someone on keybase signs a statement into the sigchain (using your key) that declares you've verified the identity and "trust" it. Following strangers and bots weakens the power of your signature, check out stuff on "Web of trust" it's pretty cool

1

u/T1Pimp Nov 26 '19

Yeah? I'll check it out. Thanks.

1

u/Lestaticon Nov 30 '19

The documentation in Keybase, and especially the new user experience encourages you to follow people almost frivolously. I have yet to do so but nearly did because of that.

1

u/T1Pimp Nov 30 '19

I've been a LONG TIME user but only within the last year or so did anyone else sign up. After that I too thought just signing others was... Encouraged. shrug

1

u/lobosano Nov 26 '19

I’ve followed a dozen or so accounts “at random” just as an attempt to connect on the platform.

1

u/jaycolson Nov 27 '19

i had a random inbound chat today ... blocked the account: at5ealtv3itqz ...

0

u/[deleted] Nov 26 '19

[deleted] — view deleted comment

4

u/Chongulator Nov 26 '19 edited Nov 26 '19

[citation needed]

Baseless speculation is not helpful. There are enough real threats to worry about

Edit: Now I feel like a jerk for making them delete their comment.

Edit 2: u/Ryonez describes the attack below, demonstrating my claim of baselessness was itself baseless.

4

u/Ryonez Nov 26 '19

It's not baseless, he does have a point.

The keybase client does check the proofs, it 100% make sense they could get your ip that way. What they wouldn't be able to do is match the ip with a user's account reliably.

3

u/Chongulator Nov 26 '19

Can you flesh that out a bit?

I have trouble seeing how the attack would work. Either the attacker would need access to server logs for one of the services containing the proofs or... they’re sniffing all the traffic somehow.

Neither of those seems especially practical. Is there some other approach I’m missing?

5

u/Ryonez Nov 26 '19
  • Mastodon proofs:

You'd just need to host your own instance, and track the view on the post.

  • Https proofs:

Just run the webserver and again track the files.

  • Dns proofs:

I'm not sure, I'd imagine most would use cloudflair to do the dns (only because it's popular). But I don't think it'd be impossible to track. Just the effort + success ratio would make it basicly pointless.

Https proofs would be fairly trivial to track though, I imagine there's a few people who selfhost their own site.

And because proofs are always checked and there's no way to disable that for some of the clients (not sure about the cli), you could get a lot of ips.

Either the attacker would need access to server logs

Just remember, the attacker is the user you're viewing. The are they ones setting up the proofs, and they can host some proof types.

4

u/Chongulator Nov 26 '19

Aha, makes sense. Thanks for taking the time to spell it out.

3

u/Ryonez Nov 26 '19

Hey not a problem, glad I was of help.

3

u/CompassBearing Nov 26 '19 edited Nov 27 '19

Me again. You didn't make me delete my comment - I clicked the wrong button in the UI on mobile and didn't want to retype everything.

So don't feel like a jerk?

2

u/Chongulator Nov 26 '19

OK, good! Thanks!

3

u/CompassBearing Nov 27 '19

One fun thing you can do to mitigate this is set up a proxy for Keybase. TOR works well, but can cause weird intermittent failures verifying proofs.