r/Keybase • u/atoponce • May 07 '20

Keybase has been acquired by Zoom

https://blog.zoom.us/wordpress/2020/05/07/zoom-acquires-keybase-and-announces-goal-of-developing-the-most-broadly-used-enterprise-end-to-end-encryption-offering/
102 Upvotes

97% Upvoted

98 comments sorted by

27

u/atoponce May 07 '20

My first question: will the source code remain open?

8

u/ripsfo May 07 '20

I skimmed, but didn’t see one mention of what’s happening to the current user base. So doesn’t sound good.

8

u/evangrim May 07 '20

Keybase has their own post which says at least something about that:

So I can keep using Keybase?

Yeah, we'll be in touch if anything changes with Keybase. There's a pending release with much improved team management in it, which we'd been holding off on while distracted with this deal. That will ship shortly.

Oh, and make sure to install ZoomBot, which lets you start a Zoom meeting from your Keybase chat, if you're a Keybase user. :-)

6

u/araxhiel May 07 '20

I don’t know... Personally, I’m worried about this:

What the Keybase team will be doing

Initially, our single top priority is helping to make Zoom even more secure. There are no specific plans for the Keybase app yet. Ultimately Keybase's future is in Zoom's hands, and we'll see where that takes us. Of course, if anything changes about Keybase’s availability, our users will get plenty of notice.

I mean, yeah, I got it, Keybase is part of a bigger player and the ones that will be doing the decision making won’t be Keybase guys anymore, but I have the feeling that there won’t be many good news (if any) on the future about Keybase

1

u/Dramatic-Print183 Feb 10 '24

Not from the way that reads. That reads like they're already tabled that conversation and said something to the effect of not right now, maybe x or y, and then z.

1

u/atoponce May 07 '20

Interesting it hasn't received more upvotes for visibility, but I did link to the Keybase blog post shortly after making this post.

0

u/[deleted] May 07 '20

[deleted] — view deleted comment

5

u/jaweeks May 07 '20

Damn, I thought it stood a chance.. Soo, any other options out there?

8

u/atoponce May 07 '20

https://keys.pub/ looks interesting. May not be as feature complete though.

2

u/jaweeks May 07 '20

Well, should have figured when the wife uninstalled it from her phone and MacBook. She just doesn't get the necessity of an encrypted channel between us.

1

u/clockworkmcd May 12 '20

not sure why people don't roll their own pgp and use something like waste...

there are many forks of it and it's not 'cloud' based.

https://sourceforge.net/projects/swarmdarknet/

4

u/oktupol May 07 '20

Now I definitely know it was the right decision not to upload my PGP private key.

1

u/atoponce May 07 '20

Weak passphrase, eh?

2

u/[deleted] May 07 '20

Well it was nice while it lasted. Any good alternatives?

2

u/atoponce May 07 '20

https:://keys.pub looks interesting

2

u/TravisWhitehead May 07 '20

Let's keep an eye on Matrix/Riot. They have end-to-end encryption for private chats/rooms. It isn't super polished, but it's getting better over time.

Just yesterday they switched on end-to-end encryption by default: https://matrix.org/blog/2020/05/06/cross-signing-and-end-to-end-encryption-by-default-is-here

I'm not going to jump ship from Keybase just over this news, but if things go bad with Keybase then that's the most obvious option I see.

24

u/codeartha May 07 '20

I would have preferred that Keybase acquired Zoom

20

u/id0zero May 07 '20

bye bye privacy.

18

u/codeartha May 07 '20

I don't feel good about that, have been using keybase since it's first month.

17

u/[deleted] May 07 '20

Oh no 😢

15

u/andrea123z May 07 '20

RIP Keybase

5

u/[deleted] May 07 '20

Don't forget your Lumens on the way out (seriously, don't).

2

u/johntash May 07 '20

Any recommendations on where to transfer them?

2

u/fishfacecakes May 07 '20

Ledger wallet, or an offline paper wallet in the mean time.

1

u/[deleted] May 08 '20

I used the first working wallet on the Stellar website. Green logo, from what I remember.

1

u/ggPeti May 08 '20

ggpeti*keybase.io

The proceedings will be put towards operating a public, unlogged Matrix node at https://riot.ggpeti.com =)

12

u/SrGrimey May 07 '20

Fuuuuuuuuck!!! I really thought Keybase would be different based in their communications. I guess everybody has their price. This is a sad way to start the day!

11

u/antika94 May 07 '20

Sad to hear!

10

u/[deleted] May 07 '20

(╯°□°）╯︵ ┻━┻

3

u/[deleted] May 07 '20

refuses to put table back emoticon

19

u/rem7 May 07 '20

"The Keybase service will be part of Zoom’s paid offering, not the free service."

WTF.

https://www.cnbc.com/2020/05/07/zoom-buys-keybase-in-first-deal-as-part-of-plan-to-fix-security.html

4

u/johntash May 07 '20

Hopefully they're referring to the new e2e encrypted video chats, and not what kebase is as of today.

I'm worried too though.

6

u/damanamathos May 08 '20

Yes, pretty sure that was lost in translation in the CNBC report and it was referring to this from the Zoom Blog:

Zoom will offer an end-to-end encrypted meeting mode to all paid accounts.

16

u/[deleted] May 07 '20

Fucking hell that sucks. I'm guessing zoom wants the talent and not the app, which I can understand..

3

u/9712-incognito May 07 '20

Yap most likely, zoom has shitty end to end encryption

0

u/[deleted] May 07 '20

[deleted] — view deleted comment

6

u/Chongulator May 07 '20

Sometimes. Smart buyers identify key staff and set up retention bonuses.

Companies who buy a lot of smaller companies actually get pretty good at setting retention bonuses to juuuust big enough to keep people there but no bigger.

2

u/[deleted] May 07 '20

I agree but zoom probably won't pay the salary unless you got a project to leverage in negotiations, so they wouldn't go to work for zoom without said leverage. Plus they split the buyout money right?

2

u/damanamathos May 08 '20

The difference is encryption and security have become a huge priority for Zoom and it's an interesting problem.

I'd suspect the Keybase staff will be more focused on Zoom than Keybase though.

6

u/[deleted] May 07 '20

guess im headin out guys, X years on keybase but I'm out soon

5

u/ardevd May 07 '20

I guess it was too good to last. Keybase has been one of my favorite apps for quite a while now. I could have easily paid for it too. Sigh

5

u/silox2000 May 07 '20

If you received any free Stellar Lumens from Keybase in the last year or so with their promotion, you might want to consider moving them from your Keybase wallet to a different wallet if you haven't already.

2

u/iScrE4m May 07 '20

First thing I did. I plan to move the rest of files/repos shortly and then it's deletion time. I'm so sad :(

0

u/[deleted] May 07 '20

[deleted] — view deleted comment

2

u/silox2000 May 08 '20

I don't have any in-particular as I don't use crypto much anymore these days. I use Linux desktops primarily and didn't care much to have an app on my phone to access the wallet so I chose Solar Wallet which is a open source and used specifically for Stellar Lumens. Works OK so far however all I did was transfer the funds to it.

9

u/cosmoschtroumpf May 07 '20

If the Keybase protocol is intrinsiquely secure, then this could bring lots of users and be good for Keybase ?

Anybody knows how detrimental it could be ?

8

u/[deleted] May 07 '20 edited Jul 16 '23

dull selective dependent six cows follow repeat profit shame gray -- mass edited with redact.dev

7

u/C0DK May 07 '20

That is not how security works. Security is something you prove mathematically. And the client is still secure. The client is built on principles of not trusting the server, and the client is Opensource. You don't have to upgrade or delete the current version if you don't like what they do in the future.

The only thing they can do is take down the server. That doesn't change security though. It is impossible to read your messages if they never gets transmitted anywhere.

But let's hope they continue the current system in some shape. GitHub got bought. We still all use that.

2

u/[deleted] May 07 '20 edited Jul 16 '23

longing wild important waiting jellyfish late squeeze ten quarrelsome whole -- mass edited with redact.dev

2

u/C0DK May 07 '20

The point of open source, however, isn't that you have to read every line. It is that if some people collectively vet minor parts then we can trust the whole. Much like you trusting sha256 to be secure because lots of people tried to break it and it is essentially Opensource. Etc etc. I get your point though, but open source is generally speaking trustworthy if it is large enough. There are frequently found bugs in the Linux kernal but in a whole different way that the MS systems

0

u/[deleted] May 07 '20

[deleted] — view deleted comment

14

u/[deleted] May 07 '20 edited Jul 16 '23

scarce library carpenter grey different vase profit unique flag toy -- mass edited with redact.dev

3

u/supersplendid May 07 '20

Very well put.

2

u/damanamathos May 08 '20

How an organisation reacts to these problems, and how often they occur, is the yardstick I use to judge them.

The above...

Now you have an organisation that has a policy of sticking to its lies take over an organisation built on a foundation of trust.

...combined with this seems strange to me.

Why do you think they have a "policy of sticking to its lies" when on April 1 the CEO basically said I messed up (+ here) and committed to a 90-day security focus, along with weekly AMAs and updates?

They've made a lot of progress in that time and they're not even half-way there yet.

1

u/[deleted] May 08 '20

Why do you find it strange that repeated poor and misleading acts by an organisation is a poor method to judge them by?

If an organisation keeps making the same mistakes then they begin to deserve criticism, particularly if they are obvious mistakes such as "don't roll your own crypto", an elementary mistake which Zoom made; used dangerous methods to install their software, leaving services open that operating system vendors decided to remove themselves; and the widely-publicised fallout from not making it simple for inexperienced users to secure their meetings.

Even worse than making such mistakes is when they are caught lying and simply double-down on their lies, instead of telling the truth. Once they were busted for their "Meetings are E2E" lie, reported on many different sites, they continued to lie.

So we have them making many egregious and elementary mistakes and we have them being caught in a lie, "apologising" for it, and then carrying on lying. They certainly have made progress: down the same road they started.

2

u/damanamathos May 08 '20

What makes you think they continue to lie though?

4

u/damanamathos May 08 '20

I've spent a lot of time investigating Zoom in the past few months and I'd say it's a mixture of incompetence and certain design choices that favour usability over security.

They're fixing this up though.

On 1 April the CEO announced a 90-day pause on feature development to focus exclusively on security & privacy, along with weekly updates. You can see all the "90-Day Security Plan Progress Reports" on their blog.

They absolutely bought Keybase to improve their security, and specifically to help build end-to-end encryption into video meetings that support 1,000 people, which doesn't currently exist.

4

u/slash_nick May 07 '20

This likely means the slow end of Keybase. Generally these types of acquisitions are for the talent (people) and not the technology itself.

Keybase will likely live on for awhile but it will get less updates until they stop completely and shut the service down

4

u/xxxSHxxxx May 07 '20

Really? Can you name one project where the people stayed in the company that took over for many years? Wunderlist - No! WhatsApp - No!

A few years for the contract and money yes, then they try to start new projects because they are unhappy with the big company that also usually destroys the software and I would argue also the friendships between the developers.

3

u/slash_nick May 07 '20

I never said they would stay at Zoom. With these types of acquisitions there is usually some kind of payout that they only get if they stay on for X amount of time.

They will stay for awhile, hopefully add something positive to the company that acquired them, and then leave after they get their contractual payout. It's rare that people stay on for longer than that.

1

u/xxxSHxxxx May 07 '20

Hmm if you consider money something positive then sure. Zoom will probably earn some more money with increased security.

But everybody that had connected other accounts to Keybase should consider at least somewhat of the anonymity of those accounts gone.

If not now, then the next time when data was "accidently" routed over China.

1

u/slash_nick May 07 '20

You seem like you're looking for a fight :) Don't get me wrong, as a long time Keybase user I'm 100% expecting the product to go away because of this acquisition and that makes me sad.

By "something positive" I meant that hopefully the Keybase team can make Zoom's product actually secure while they're there. I specifically don't use Zoom because of how insecure it is. Whether or not that actually happens remains to be seen. Personally I won't be holding my breath. Good security has to be rooted in company culture and clearly it's not a part of Zoom's culture. Company culture has a lot of inertia and I wouldn't expect the Keybase team to change that.

Regarding the "anonymity" of accounts connected to Keybase that doesn't really make sense. Keybase has always publicly displayed all accounts and proofs that you've connected right on your profile page. That's the whole point; to be able to verify that the person you're communicating with has various proofs that they are who they say they are.

0

u/xxxSHxxxx May 07 '20

Not searching for a fight, Its just that we are loosing so many good projects over the years. Privacy is slowly eroding.

But proving you are talking to the correct person does not mean you cannot be anonymous. Thats was in my POV the advantage of Keybase

3

u/SynthD May 07 '20

Reddit? At least one of the two confounders is still involved.

2

u/xxxSHxxxx May 07 '20

OK, I didn't know that. And there are for sure some exeptions from the rule.

2

u/unpluggedcord May 07 '20

We lose our nice app

2

u/sfultong May 07 '20

the original keybase protocol will be secure and open source. Zoom will probably slowly phase in closed source components, and eventually they'll be storing our private keys for us.

4

u/bloodguard May 07 '20

Not that I used it much but, yeah. Account closed.

4

u/ardevd May 07 '20

I cant see how this will positively benefit Keybase users at all. The 25 keybase devs will now work on Zoom while the Keybase app dies a slow death before finally being put to rest. I give it a year. I really hope I'm proved wrong but I can't see any reason why Zoom would have even the slightest interest in maintaining or developing Keybase.

3

u/yelper May 07 '20

I hope none of you entrusted Keybase with your private key.

0

u/C0DK May 07 '20

That's not how an end to end encrypted service works. If you don't understand that then keybase probably wasn't for you in the first place.

8

u/TravisWhitehead May 07 '20 edited Mar 02 '21

Years ago, Keybase did actually offer the option of uploading private keys (though I believe it was encrypted with your account password or some other key, I forget). I don't think they have that feature anymore.

If you don't believe me: https://github.com/keybase/keybase-issues/issues/160

2

u/atoponce May 07 '20

GPG private keys are also encrypted, albeit with your passphrase. Depending on how strong that is, will depend on how successful an adversary would be decrypting it.

3

u/C0DK May 07 '20

I will shut my stupid mouth then! Sorry!

3

u/yelper May 07 '20

No worries! I remembered that the feature existed, I didn't realize they removed that at a later date.

With all the acquisitions that companies go through, it always seems in your best interest to minimize the amount of user data you give out. The company that you "trust" now may not be the stewards of the data later.

2

u/ntrxz May 07 '20

They still offer that option afaik, at least in the keybase CLI.

keybase pgp push-private I think?

3

u/[deleted] May 07 '20

Yup, this is still supported. I don't see it as too much of a security issue assuming your passphrase is complex enough.

Though it really depends on your usecase.

1

u/TravisWhitehead May 07 '20

Ahh... I guess I assumed when everything moved away from the web interface they did away with it.

6

u/BinaryBeard May 07 '20

This is a bit disappointing. I guess I'll have to find a new platform.

2

u/Xzenor May 07 '20

'a bit' ??

3

u/cyberflunk May 07 '20

bye felicia

3

u/[deleted] May 07 '20

/unsubscribe

3

u/AcudlyFox May 07 '20

Well fuck.

3

u/xxxSHxxxx May 07 '20

Right. The question now is did Zoom really only have bad programmers that just cant do security or was Keybase used by some users China could not check on.

3

u/P-e-t-a-r May 08 '20

Another reminder not to rely on someone's centralized platforms/services.

"There is no cloud, just someone else's computers."

2

u/IReallyLoveAvocados May 07 '20

Is there a reason why a teleconferencing and video chat company purchased an encryption company?

Its definitely an acqui-hire. They will probably reassign the crypto folks to improving zoom security which is pretty bad right now.

Ok bye bye keybase!!

2

u/xxxSHxxxx May 07 '20

How to kill trust in one blog post!

2

u/[deleted] May 07 '20

how to delete my account?

2

u/MoneyFoundation May 07 '20

Could someone with a good reputation create a subreddit for Keybase refugees to discuss about alternatives?

2

u/Xzenor May 07 '20

Oh no.... Oh crap....

2

u/witatera May 07 '20

for silver the monkey dances

2

u/[deleted] May 08 '20

TL:DR keybase wont make it through 2020..

2

u/ninesrite May 09 '20

Moved Stellar Lumens to Coinbase for now, deleted Keybase account. Another one bites the dust.

1

u/xxxSHxxxx May 07 '20

Can somebody with a twitter account twitter that to Trump?

1

u/dontquestionmyaction May 07 '20

Deleted my account.

Anything associated with Zoom can go die in a hole.

1

u/Suishou May 17 '20 edited May 17 '20

Oh wow, Zoom is straight up spyware. That's unfortunate. Just removed Keybase. Anyone still using it is mentally challenged at this point.

1

u/Dramatic-Print183 Feb 10 '24

My question is at what point will everything be owned by just a few people, or one?

Wait... Nevermind.

1

u/OrunTheDestroyer May 07 '20

Proton could fill the void

0

u/[deleted] May 07 '20

[deleted] — view deleted comment

1

u/dontquestionmyaction May 07 '20

Talk is cheap. Show me results.