Zoom Acquires Keybase

https://keybase.io/blog/keybase-joins-zoom

by vikram7 • 6 years ago

1879 703 6 years ago

grenoire• 6 years ago

I don't quite know how to feel about this. Perhaps it is my mistrust against Zoom, but I did enjoy the run Keybase had as a semi-independent key and ID manager.

Latty• 6 years ago

Yeah, with the recent issues they had after doing the cryptocurrency stuff (which didn't really bother me, but it definitely seemed to generate some negative feelings in general), this feels like a poorly-timed move.

Zoom is presumably going for "look, we are bringing on-board this team of trusted people who understand privacy", but I think most are just going to assume it'll work the other way and Zoom's culture of poor security practice will bleed into Keybase over time.

freen• 6 years ago

And I’m done with Keybase.

What’s that open source alternative that someone recently posted here?

nathcd4• 6 years ago

keys.pub:

https://news.ycombinator.com/item?id=22995792

https://keys.pub/

abdullahkhalids• 6 years ago

This project is in development and has not been audited.

thinkmassive• 6 years ago

Whoa, how much? The press release doesn’t say, but this will come out eventually since Zoom is publicly traded, right?

preinheimer• 6 years ago

Congrats to the keybase team! They seemed to grow in fits and starts, hopefully this sort of thing helps push encryption to even more places.

richardknop• 6 years ago

Strange combination.

jrockway• 6 years ago

Why? Keybase's product is team chat. Zoom wants to kill Slack. Seems perfect.

(Keybase's crypto stuff is nifty, but we all know there is no money in that. They tried to make money by integrating cryptocurrency, and people did NOT seem to like that. So here we are.)

lord-squirrel• 6 years ago

Never thought of Keybase as a team chat product. Maybe thats just because I'm one of the older users :)

eganist• 6 years ago

Congratulations, malgorithms and team!

Selfishly hoping the cores service isn't shut down, though. I've been using it authoritatively for 5+ years. Treasuring the username I got too.

DyslexicAtheist2• 6 years ago

time to ditch keybase

frisco• 6 years ago

I had such high hopes for Keybase; kbfs had completely replaced Dropbox for me. This is terrible news.

souterrain• 6 years ago

This is precisely why Zoom is acquiring Keybase. Zoom seeks to become the single "remote work tool", challenging Dropbox, et al. directly.

I'm particularly disenchanted with the growth of these multipurpose tools, but I am not their target audience. (Nor, I suspect, are many HN participants, but this is a baseless guess.) I suppose I'm more of an adherent to so-called "UNIX philosophy"--the best, single-purpose tool for each task, preferably that can be combined with its like for a solution customizable to how a specific user gets work done.

_asummers• 6 years ago

Zoom seeks to become the single "remote work tool", challenging Dropbox, et al. directly.

Maybe they should work on the fact I can run Zoom in screen share and just about nothing else. Just entering a call for me takes ~75% of my CPU and I beach ball regularly when screen sharing lightweight text editors doing barely more than scrolling and typing.

jadia• 6 years ago

Yes. I recently started exploring keybase. I extensively use their filesystem and private git repo. Sad to see them go.

mixturez• 6 years ago

Wow. why?. Bye keybase

freewizard• 6 years ago

Guess I shouldn’t be surprised. After all, Microsoft acquired GitHub, IBM acquired RedHat.

searchableguy2• 6 years ago

Many weird acquisitions past few years but all make sense from a monopolistic angle.

Startpage by an ad company.

PIA by an anti privacy malware company.

Keybase being a slack competitor merging with zoom makes much more sense in retrospect. Zoom is insecure while keybase is seen as secure.

Companies are purchasing competitors or revenue stealers.

Kipters• 6 years ago

Congrats to the keybase team, but I guess I'll just stop using it

steve_adams_862• 6 years ago

Likewise. My friends and I have been using it throughout the pandemic to chat, I've been using it for years, but we're all deleting our accounts this morning. All around unsettling news as far as keybase software goes. Congratulations keybase team, though.

otachack2• 6 years ago

I'm curious where Keybase refugees are going to end up. Matrix? Telegram?

f38zf5vdt4• 6 years ago

Zoom: Well boys, we did it. Privacy problems are no more.

pbnjay• 6 years ago

Oof. Keybase was struggling to define what exactly it was, so I guess they is the best exit option for them anyway...

cowmix• 6 years ago

Thank you!

I've been using it on and off for years.. I'm still not sure what exactly it is or under what circumstances I should be using it.

soulofmischief4• 6 years ago

I use it for shared network storage, frictionless private git repoisitories, basic static web hosting, personal and work chat, and I make heavy use of the teams feature. Not a day goes by I don't use it for something.

rvz3• 6 years ago

Looks like it wasn't a good idea to leave your private keys in Keybase's servers was it?

Perhaps the moment that Keybase took VC funding a while back, it was over to begin with and the principles of being a "Slack competitor" and respecting their users privacy went straight out of the window and into the bin.

I really had high hopes for Keybase as a Slack competitor, the cryptocurrency stuff I actively ignored, but this is a disaster.

Fission Mailed.

vr46• 6 years ago

This is a complete disaster.

gspr• 6 years ago

Wait, what? People gave Keybase their private keys?? Isn't keybase just some glorified modernized web of trust infrastructure?

coldpie9• 6 years ago

It was well-intentioned. For a time, Keybase provided users the option to upload their private keys so they didn't have to maintain them themselves. You could just log into Keybase and send signed messages, decrypt messages, etc without the hassle of managing your keys locally. It was definitely a bad idea and I think they dropped it a few months/years later, but it at least wasn't totally out of left field.

dcow13• 6 years ago

No, they didn't. There is an option to have Keybase sync a [backup] copy of your private key(s) between your devices for you but the key is encrypted by you. And, none of their stuff like chat or git etc. depends on using/accessing those keys in anyway (they built out their own domain-applicable pki for that—in other words, chat doesn't use pgp). It’s just a convenience option for those who want it and it’s not the default.

dcow13• 6 years ago

Or, maybe Keybase needs video, and Zoom needs chat and security, in order to compete with the new wave of “productivity” suites. Why would Keybase suddenly be a failure or get worse in the security department because they are owned by a successful video conferencing company?

deathhand• 6 years ago

It's deeper than "Chat Security". There is current litigation against Zoom marketing of the misuse of 'end to end' encryption. This is the best way forward of claiming ineptitude and their path to rectify.

maximente• 6 years ago

honestly the real security fail in keybase seemed to be users flocking to add every single social media identity to their keybase account, allowing anyone using the public API to remove all doubt that greg1234 on twitter == karl5912 on reddit == john1005 on HN, etc.

scrape all those social media posts, reddit subs, etc. and you've probably got a solid idea of who that user is. all under the guise of public FLOSS stuff.

tomcatfish• 6 years ago

That's not a flaw, that's the main feature I was using it for.

efreak2• 6 years ago

Or you can just use keybase to only add your accounts that already have the same username and leave the others disconnected.

cityzen• 6 years ago

"We are excited to integrate Keybase’s team into the Zoom family to help us build end-to-end encryption that can reach current Zoom scalability."

you mean... to help you sort out your false advertising.

I just pulled a random page from Dec 25 of 2019 from internet archive where the site says this:

https://d.pr/i/w3Ac0f

Meet securely End-to-end encryption for all meetings, role-based user security, password protection, waiting rooms, and place attendee on hold.

https://web.archive.org/web/20191225055029/https://zoom.us/m...

Fake it til you make it?

cbg0• 6 years ago

Zoom does not and will not proactively monitor meeting contents, but our trust and safety team will continue to use automated tools to look for evidence of abusive users based upon other available data.
Zoom has not and will not build a mechanism to decrypt live meetings for lawful intercept purposes.
We also do not have a means to insert our employees or others into meetings without being reflected in the participant list. We will not build any cryptographic backdoors to allow for the secret monitoring of meetings.

One court + gag order and all of these promises are out the window.

GurnBlandston• 6 years ago

Let alone the legalese included that makes 'will not' lose any meaning at all.

degenerate• 6 years ago

Consider these promises a warrant canary. They will be removed at some point.

sdlkfgj• 6 years ago

only that it is not.

warrant canaries must be written in the past tense. This is future tense. So they can monitor millions of calls, and give your information away at every second. This text only tells you about the next second (a promise they will break too, but then the text will be about the next second)

SahAssar• 6 years ago

I thought warrant canaries had to be in financial reports because those are one of the documents where companies are legally cannot lie under SEC rules?

blackkat• 6 years ago

“...will not proactively monitor...”

“...will not build a mechanism to decrypt live meetings...”

So, this means that they can record meetings, then retroactively decrypt and monitor meeting contents :)

foobiekr2• 6 years ago

The statement about lawful intercept can only be considered a blatant lie. It’s a requirement in China and CALEA applies in the US. Europe, India and Australia have their own laws around this.

jlgaddis2• 6 years ago

What makes you think that CALEA applies to Zoom (in the U.S.)?

IANAL, but I'm reasonably confident that it does not.

notriddle• 6 years ago

Well, yeah, duh.

What do you expect them to do? Hire a PMC and fight a war with the police when they come around to raid the server room? Go into hiding so that the security agency can't steal the upgrade signing key from them?

We can't expect all of the internet to operate like Wikileaks and The Pirate Bay. If the justice system is broken, then the people aren't safe.

oehpr• 6 years ago

What do you expect them to do? Hire a PMC and fight a war with the police when they come around to raid the server room? Go into hiding so that the security agency can't steal the upgrade signing key from them?

No, we want them to assume the same thing we are assuming. That if their service becomes successful, they will be coerced to compromise their users, regardless of how frequently they promise that they would never do so.

If they are even bothering to make public announcements like this, then that means they believe the security of their system can be founded on the honor of their employees. It's important to recognize that this isn't even true if you assume every member of their team is an uncorruptible seraphim.

Instead, where possible, the service should be zero knowledge, where not possible, it should be considered insecure.

mirimir6• 6 years ago

We can't expect all of the internet to operate like Wikileaks and The Pirate Bay.

Why not? That's just what it takes.

If the justice system is broken, then the people aren't safe.

It is, and they are. After 50 years under the heel of the war on drugs, how is it not 100% obvious?

teknologist2• 6 years ago

Building reasonable end-to-end encryption in the first place isn't rocket science. In fact, Keybase have done just that. As well as WhatsApp, Signal, and many others.

kyboren2• 6 years ago

It also does not say that they have not provided key material or RNG output, or that they have not deliberately weakened any aspect of their design other than "cryptographic backdoors" to accommodate law enforcement desires.

These kinds of statements are typically most usefully interpreted as a template for the kinds of things they plan to do, just maybe not exactly in that way.

Communitivity2• 6 years ago

Given the security concerns around Zoom, and the apparent lack of QC that might have prevented those concerns, this news is appalling. I love Keybase, it's used by many people, but I suspect it will now die a quick death. More accurately I suspect it will slide into a coma - not quite dead, but not in wide use anymore either.

coldpie9• 6 years ago

Yeah holy crap. I've been a big fan of Keybase since they launched, but this is a deathknell. I guess I'm not too surprised, Keybase didn't seem to have a business model, but still, disappointing that they're going to go into death this way.

Attention people starting businesses: VC funding is fun and all, but please, have a business model. Your users and employees depend on it.

epanchin• 6 years ago

While honourable advice, the bottom line is Keybase sold without having a business model.

So perhaps better advice is, start a business even if you don’t have a plan and someone may buy it anyway.

falcolas• 6 years ago

Sometimes, acquihire is the business model. It makes money for the VCs and money for the founders. It's just the fools^wconsumers who bought in early (and the non-essential employees) who get the shaft.

_Microft• 6 years ago

What's our business model, how are we making money? Umm... don't ask me - I'm just the founder!

The sad thing is that you need to remind people of it. I would never start a business without an idea of a viable business model for it. What do they expect? Growing until they are too large to fail and then ... Godot arrives and everything is fine?

ithkuil• 6 years ago

why not look at the problem the other way around?

I don't have much respect for zoom's security practices, while I do have much respect for the keybase team.

Perhaps this is Zoom's way of admitting that there is no way they can just solve the problem internally by keeping doing what they're doing and they need to get some fresh blood and build upon good practices designed outside their current culture.

geerlingguy2• 6 years ago

I'll take what you're drinking ;-)

andrepd• 6 years ago

Then why acquire? Why not just hire as a consultant?

frogpelt• 6 years ago

It seems that we live in an era where if you made bad decisions in the past, you can never be trusted to make good decisions ever again. Even if you own your bad decisions and show lots of improvement.

Nope. Once a pariah, always a pariah.

munchbunny2• 6 years ago

In general, when it's between fresh blood and old management, old management will win every time.

If Zoom is acquiring Keybase because the C-suite is pivoting culture around security, then it'll probably work. Otherwise, not much will change. So until I see more evidence that Zoom's upper management had a change of heart (creating a CISO council is a good start), I'm going to be skeptical that this will actually move the needle.

doyoureallytnot• 6 years ago

I really hope that's the case, for Zoom's sake. Unfortunately, that means less than nothing to me; I don't use Zoom, whilst I do use Keybase.

I don't trust Zoom to be custodians of the Keybase company or software. This has been a real blow to my confidence in them and I'm not sure I'll continue to use Keybase :(

gonehome11• 6 years ago

I actually love Zoom as a product - far and away the best product in its class and this move likely makes sense for Zoom.

The disappointment comes from the loss of Keybase and what it could have been.

The main problem is Zoom having most of its development done via companies based in China. This means it is no longer possible for Keybase to achieve its original goal (and whatever encryption they add cannot fix this core problem).

It's one thing to accept the risk for video conferencing, but it's another to accept for an encryption ID standard.

I agreed with Chris Coyne's comments on HN a while back when he argued that the closed source server code didn't matter because of how they handled the encryption (when compared to Signal). While that's still true from a technical security standpoint, it looks like it does matter in a larger sense because this kind of sale shows that you can't really trust a company to act in its user's interests long-term.

bkanber2• 6 years ago

I agree. I'd bet all the cash in my wallet that this was Zoom doing a talent acquisition, to bring a team of crypto experts on board.

monadic23• 6 years ago

Has an acquisition ever worked like that in practice? I’ve heard that github might qualify but... Keybase ain’t no github.

munificent2• 6 years ago

why not look at the problem the other way around?

Because no one ever buys or hires a conscience. If you thought a conscience was worth having one, that implies you would already have one and thus wouldn't need to outsource it in the first place.

Ethics always rolls downhill. If Al Capone goes out and hires Mr. Rogers, the power imbalance between them means Mr. Rogers is going to get dirtier than Capone will get clean.

geerlingguy2• 6 years ago

Yeah for the few people in the world who actually used Keybase and understood (at least partially) why it was a neat thing... most of those people are also those who have been following the Zoom debacle, and will likely consider abandoning the platform.

searchableguy2• 6 years ago

Might not be significant part of keybase and bots don't need privacy. ;)

bitexploder• 6 years ago

Even as an information security practitioner that cares a great deal about privacy I am just not willing to jump on this "Zoom is bad" band wagon. "Zoom is bad" is a tech media narrative largely driven by the large players that have something to gain by seeing Zoom stumble. There may be QC concerns, but in general the product has been great for our team and our consensus was to give them some time. Their response has been positive and they seem to have handled it transparently. Reality says this: Zoom works well enough. When we started using it several years ago it was far ahead of the competitors. Maybe they are catching up? Anyhow, I will give Zoom a chance to do the right thing over the next 6-12 months regarding Keybase, and their product in general.

kgraves2• 6 years ago

I'm seeing a certain pattern here, aren't we all just fooling ourselves?

Isn't this just all inevitable? Aren't all these startups just lining up all in the hopes just to get acquired?

I guess when we see VC Funded™ on any startup what it _really means_ is that:

"We are prioritising a return for our investors even if it means violating our mission statement".

Galaxeblaffer2• 6 years ago

We need a new type of company that can never be acquired.

techntoke2• 6 years ago

DAO:

https://en.wikipedia.org/wiki/Decentralized_autonomous_organ...

lidHanteyk• 6 years ago

By definition, worker coops are never acquirable by private controlling interests; they are always employee-owned.

ValentineC4• 6 years ago

Ghost (blogging software) chose to incorporate as a Company Limited by Guarantee [1], which doesn't have shares and can't be acquired that way: https://ghost.org/changelog/moving-to-singapore/

[1] https://en.wikipedia.org/wiki/Private_company_limited_by_gua...

eli• 6 years ago

For most, sure. How else do you "exit"? It's not a great time for an IPO. Nor for raising money.

So either you're self-sustaining and are in it for the long haul, or you're looking to get acquired.

olah_12• 6 years ago

I think it is inevitable, yeah. But, this wouldn't have been a problem if the product itself was decentralized.

For example, if it was optional to connect to the Keybase network to begin with.

Imagine a keybase-type app that is built on web of trust rather than centralized servers.

dcow13• 6 years ago

Wait what? That's called PGP. And people like to hate on it because it's a decentralized web of trust. The whole point of Keybase is to pave over the problems with web of trust by creating a social identity layer that more accurately reflects how trust relationships actually form.

An open source social identity attestation layer that people can operate and federate. Now that sounds cool!

kentonv• 6 years ago

No, that's not how this works.

This outcome is almost certainly seen as a failure by the VCs. It looks like an acquihire. If so, it's quite possible that the VCs didn't even get their money back. Acquihires generally do not return money to VCs -- obviously, given that the employees are free to work anywhere, the acquirer's interest is in paying as much as possible to the employees and as little as possible to the now-worthless acquired company.

It's likely the employees are the ones benefiting most from this outcome, in that their pay has probably gone up considerably and they are no longer nervous about their job security, after many years of high stress and low pay.

It's possible the VCs were even offering some more cash to keep going, but at unfavorable terms, and the team said: "No, we'd rather take the big paychecks from Zoom."

Given Keybase has only had one funding round (according to crunchbase), the founders certainly still had a controlling stake in the company and the VCs couldn't force them to sell or not sell.

You can blame VCs for a lot of things but this kind of outcome is just not one of them (except insofar as that it allowed a company with little viable business strategy to exist in the first place).

(I am the founder of a failed startup. We had multiple "acquihire" offers, none of which offered any money back to investors.)

mi100hael• 6 years ago

Typical VC terms give them veto rights over future deals even though they are minority stakeholders.

Frost1x• 6 years ago

My two cents: that's part of the game in today's marketplace. It's pretty difficult to 'disrupt' firmly cemented market footholds and play with the big boys with seemingly endless streams of capital (though it certainly is possible, tech is more notorious for this than most industries, though highly improbable).

You really want to lock down some strategic IP that stands in the path of a behemoth and hope they'll want to aquire it under their growth goals or attempts to stomp out potential competitors (by throwing money at them and not through litigation or other paths). The big boys win because they buy out proven effective solutions/IP and models while failed startups eat the market high-risk exploratory costs.

ddevault3• 6 years ago

The fact that the ultimate goal of most startups is to "exit" says an awful lot. It's an obvious signal that they are not prioritizing your needs in the long-term.

arto• 6 years ago

Seems a rather poor cultural fit, to say the least.

zegl• 6 years ago

First, a huge congratulations to the founders of Keybase! Running a self-founded messaging company can't be an easy feat.

For me personally, this is of course worrying news. I'll suspect that Keybase will die a rather quick death, as most of it's users are security minded that wouldn't ever trust Zoom.

roblabla2• 6 years ago

Keybase' post about the acquisition: https://keybase.io/blog/keybase-joins-zoom

What the Keybase team will be doing
Initially, our single top priority is helping to make Zoom even more secure. There are no specific plans for the Keybase app yet. Ultimately Keybase's future is in Zoom's hands, and we'll see where that takes us. Of course, if anything changes about Keybase’s availability, our users will get plenty of notice.
So, our shortest-term directive is to significantly improve our security effectiveness, by working on a product that's that much bigger than Keybase. We can't be more specific than that, because we're just diving in.

So, yup, keybase is dead.

INTPenis• 6 years ago

How can they be so obvlivious though? Their own blog post doesn't even mention the tarnished reputation Zoom has acquired lately.

A lot of people will stop developing integrations for Keybase because of this. It's sad.

mc32• 6 years ago

They’re not oblivious but two things; you don’t bite the hand that feeds and it’s easier to get someone to see your side of things when you agree with them. Confrontation will not help to fix Zoom’s culture of insecurity.

mtmail• 6 years ago

Zoom is publicly traded. Assume their blog post had to be approved by Zoom's press department.

momokoko• 6 years ago

They aren’t. They are making a lot of money which is what the business was made for.

The post is actually refreshingly honest that keybase is now abandoned and will probably die at some point.

The idea that companies were stupid enough to place their internal identity on some random 3rd party is so incredibly stupid that it’s hard to feel too bad for anyone.

Congrats Keybase!

coldtea• 6 years ago

How can they be so obvlivious though? Their own blog post doesn't even mention the tarnished reputation Zoom has acquired lately

I'd say, don't overestimate the tarnished reputation (= some news stories for a while, most didn't read or care about -- including corporate users).

And of course they wouldn't get into it in a press release/blog post for an unrelated to the issue acquisition! Doesn't make sense to sabotage themselves this way...

bjoli• 6 years ago

Sure, the reputation might be tarnished, but to it seems like they have hired recently to ensure people that they are taking measures to change that.

This seems like an extension of that. If anyone has thought a lot about multi-party encrypted communication it is the keybase folks.

verytrivial• 6 years ago

doesn't even mention the tarnished reputation Zoom has acquired lately

I'm interested to know if you thought keybase doing the whole unsolicited Initial Coin Offering was a reputation tarnishing or polishing event for that company. (I'm circumspect about both of these outfits to be honest.)

tensor• 6 years ago

That's probably why Zoom is buying them, to double down on security and repair their reputation. They genuinely seem to be putting all their focus on improving security. Seems like a smart buy to me.

dcow13• 6 years ago

I don’t necessarily read it that way. Keybase is 100% functional and has worked well for a long time. Zoom needs people who know how to make modern client software and chat if they want to compete with the Slacks and Teams, etc. You can’t even screen share on wayland... it’s that bad. If keybase ultimately gets secure video, and zoom a security architecture overhaul, how is that a bad thing?

coldpie9• 6 years ago

Well, it's pretty clearly an aquihire. Zoom gets a team of highly skilled cryptographers and Internet protocol experts. Good for them. But that means the team that created Keybase as an innovate PKI store won't be working on that anymore. That's not Zoom's business, and probably won't be, as Keybase themselves never figured out how to turn it into a business.

plebian• 6 years ago

Zoom is actually one of the view applications that can screen share on Wayland

I believe it's only enabled for a few distros though

f38zf5vdt4• 6 years ago

If Keybase acquired Zoom (haha), then, sure. This is a PR move for a public company. They'll probably gut Keybase, move their Chinese server generated AES128 keys to AES256 keys generated by you and uploaded to their Chinese server, then call it a day.

I can't think of a single instance where acquisition of a smaller company like this resulted in an improved version of the original product. How many of us are running RHL? Skype is now close to Microsoft spyware that's impossible to remove from a Windows installation. Facebook purchasing Whatsapp, another service that formerly stressed encryption, resulted in things like plaintext backups of your texts on Facebook servers being aggressively promoted as soon as you loaded the app.

It's pretty much always cheaper to gut the original product, ignore the problems with your software, and enjoy the enhanced price of your shares while effectively spending no more money than you had for the original acquisition. As far as I can tell, Keybase has never had a business model or constant source of revenue.

pavel_lishin• 6 years ago

If keybase ultimately gets secure video, and zoom a security architecture overhaul, how is that a bad thing?

If.

johnchristopher2• 6 years ago

Is wayland support even a femto blip on Zoom's radar ?

core-questions2• 6 years ago

Who gives a fuck about Wayland, honestly? It seems like it was designed by people who didn't like the few good things about X and wanted something to further fracture the Linux desktop. Well, they got it.

Zoom needs people who know how to make modern client software

It's the best video client available on Windows / Mac and works acceptably on Linux, what exactly needs to be more "modern" about it? Slack's video call thing is way less featureful, and Teams is still the abortion that is Lync / Skype for Business under the hood which is and always will be shit-tier.

chat

I don't want my video app to be my chat app. There's any number of reasons why separation there is a good thing. I can start a Zoom call from Slack in 1 second, what more do I really need on that front?

OJFord2• 6 years ago

Isn't getting bought and there being no plans for your business bonkers? Or at least, it's a bonkers/highly-unusual admission that it's an acqui-hire.

pwinnski• 6 years ago

Bonkers how? Zoom gave them money, they took the money.

cactus2093• 6 years ago

I remember thinking they were neat a few years ago, I made an account and tried out exchanging some keys. It’s slick but I don’t see how it was ever going to be a mainstream product for non technical users who mostly don’t even understand what encryption is. Haven’t heard anything about them since, I kinda already assumed they were dead.

dgellow2• 6 years ago

It doesn’t have to be mainstream. A niche product can be viable.

Unless you begin to accept investors money who want an exponential growth at all cost. But if that’s what you want as an investor, no idea why you would invest in Keybase.

bloopernova2• 6 years ago

So, yup, keybase is dead.

Well, shit.

Keybase had an amazing potential. I use it every day to ad-hoc securely share/store stuff. It will be sad to see it wither even more than it has. :(

neltnerb3• 6 years ago

Lucky for us it is open source? I was hoping to use it to replace Dropbox but they kept not taking my money... small wonder they went for the acquisition.

herval• 6 years ago

While it's a cool tool, what exactly was the (commercial) potential Keybase had? I could never tell.

xiphias2• 6 years ago

,,helping to make Zoom even more secure. ''

Wow, this means that keybase stuff thinks that Zoom is secure already. Zoom should have hired people who don't think that way.

dasil003• 6 years ago

Keybase product and engineering do not think this way. Corporate PR thinks this way. Don't get it twisted.

lgessler• 6 years ago

Come on, the engineers at Keybase are serious crypto nuts. Give them some more credit

pornel• 6 years ago

Keybase was dead as soon as they took VC money.

Their original purpose — tying identities to keys — could have been a nice small non-profit. But there aren't fortunes to be made from managing GPG keys, so they had to pivot into shark jumping.

zelly3• 6 years ago

https://pgp.mit.edu/

hosh2• 6 years ago

We have letsencrypt and permanent.org as non-profits. An idea of a identity and key non-profit sounds like another critical piece we would need for a free, open web

StreamBright• 6 years ago

Why would it be?

fwip• 6 years ago

Sounds like good timing that https://keys.pub has become usable recently. :)

emersion• 6 years ago

https://keybase.io/account/delete_me

ashconnor• 6 years ago

Make sure you sell your free Lumens before you delete your account. I got $55 a few months ago.

nathcd4• 6 years ago

Anybody else having trouble deleting their account? When I go to /account/delete_me, I get redirected to /?next=%2Faccount%2Fdelete_me, which is just the home page. Also, I get the logged out navigation bar even after logging in. Logging in seems to just redirect me to my own profile page. (I've got my content blockers disabled, etc.)

Edit: deleting my cookies and re-logging in did the trick, in case anybody else hits this issue. After re-logging in I now have one fewer cookie than before, so I must've picked up an extra cookie that was screwing with their auth handler or something.

drcongo• 6 years ago

This is horrible news.

TomGullen• 6 years ago

Zoom trading at ~1,700 P/E which to me seems absurd. Wonder if the acquisition involved much stock! Seems like a good time for Zoom to make transactions like this.

davedx• 6 years ago

Can you explain this in a little more detail please? Would love to understand more.

dpflan• 6 years ago

Sounds like: stock price is high so use its value to its full extent while the price is high and more valuable. Allows selling/granting of fewer shares of stock too.

durkie• 6 years ago

I think the thought GP was expressing was that it would be a good time for Zoom to make an acquisition of Keybase paid for in Zoom stock since Zoom stock is trading at a very high multiple of Zoom's earnings.

Some people would regard this stock price as unsustainable compared to historic/similar earnings multiples, and that the stock will likely decrease in value in the "near" future. So from Zoom's perspective they may as well buy as much as they can while their Zoombucks are worth a lot since they'd be parting with fewer shares now than if they made the transaction later on.

m3kw93• 6 years ago

PE is price to earning, but if you look at earnings when is very low(barely making a profit), the number will be very high. So people tend to project the Earnings a year or so, and it would fall drastically.

underyx• 6 years ago

Keybase's side of the announcement: https://keybase.io/blog/keybase-joins-zoom

What the Keybase team will be doing
Initially, our single top priority is helping to make Zoom even more secure. There are no specific plans for the Keybase app yet. Ultimately Keybase's future is in Zoom's hands, and we'll see where that takes us. Of course, if anything changes about Keybase’s availability, our users will get plenty of notice.
So, our shortest-term directive is to significantly improve our security effectiveness, by working on a product that's that much bigger than Keybase. We can't be more specific than that, because we're just diving in.

They're not even making the usual "Zoom is committed to keeping Keybase alive" promise :(

swyx2• 6 years ago

is this an acquihire then?

jng2• 6 years ago

If so, it would be in the unusual shape that it is a top-dollar one rather than cover-the-failure-with-a-pretty-ending one. But in this case, Zoom is probably actually interested in the security tech that Keybase has apart from the talent, they're just not interested in the product.

benhurmarcel2• 6 years ago

Do "acquihires" work in practice? It reminds me of this Dilbert comic: https://dilbert.com/strip/2014-07-31

m3kw93• 6 years ago

They are buying Keybase to shore up their security, why would they still give them time to keep it up unless, they want to also integrate their message service into Zoom chat.

seemslegit5• 6 years ago

"to make Zoom even more secure." I mean, this might take a while.

seba_dos12• 6 years ago

I can easily see the words "even more" being added only after rounds of reviews :P

dang4• 6 years ago

(We've since changed the URL from https://blog.zoom.us/wordpress/2020/05/07/zoom-acquires-keyb... to that one)

sincerely2• 6 years ago

Hi dang, are there any plans to introduce a marker of some sort so that people know whether the current URL is the same as the one it was submitted with? I find that often I have no idea what the comments are talking about

highlysyntropic• 6 years ago

When I first heard of this purchase I thought, this is PR for Zoom to recover from its recent sec fails.

ForHackernews• 6 years ago

Zoom Acquires Keybase and Announces Goal of Developing the Most Broadly Used Enterprise End-to-End Encryption Offering

So is this real end-to-end encryption, or Zoom-brand "end"-to-our-server-to-"end" encryption?

nullc• 6 years ago

So does this mean getting marketed sketchy cryptocurrencies during your teleconferences, sending your PGP keys to random servers in other countries, ... or both?

Relevant to the acquisition, perhaps: https://web.archive.org/web/20191122031523/https://github.co...

ddevault3• 6 years ago

Keybase helped me to identify a trend in the software industry: using a pretty UI to cover up the disruption of an open ecosystem with a closed, centralized replacement. Keybase seemed cool on the face of it - making encryption easier is a laudible goal, and PGP certainly could use the improvement. But, thanks to Keybase, now I ask different questions upfront. Beware the Keybase formula:

1. Integrates with an existing, open ecosystem

2. May have open-source clients, but server is closed source and does not federate

3. Pretty UI and good marketing

4. VC funded

kgraves2• 6 years ago

I think we could just stop at:

VC Funded™

edraferi• 6 years ago

I wonder if we’ll get a fully open source release of the Keybase server out of this. It would be so awesome as a federated ecosystem...

oever• 6 years ago

Sounds like protonmail.

ddevault3• 6 years ago

Fascinating.

gruez• 6 years ago

They’re vc funded?

fmpwizard• 6 years ago

I don't know their revenue numbers, but protonmail offers paid services, unlike Keybase. I hope protonmail doesn't go the same path.

adtac• 6 years ago

it's more about the VC funding than anything else. it is almost always the reason for the death of cool software

api2• 6 years ago

The reason for the death of cool software is that nobody pays for software anymore.

Legogris6• 6 years ago

I don't know how many people here remember the excitement when Android was new and, OMG, it's Linux! Open source! Finally we have a Linux-based, free and open phone platform!

I actually think that this played a non-trivial part in Android getting early traction - similar dynamic to Gmail where tech people got excited about it eventually "my friend who's good with computers recommends this" becomes a factor.

Not the exact same formula as you formulate above, but I think there are parallels to draw.

Embrace, extend, and extinguish, and all that.

seba_dos12• 6 years ago

I was very excited about first reports on Android. I was young, starting to earn my first money, and I wanted to spend that money by getting myself my first, awesome, Linux-powered smartphone by Google - a company I heard only good things about.

Fortunately, I've decided to go with Openmoko instead back then. I'm so glad I did.

notpushkin5• 6 years ago

Same happened with Telegram: from a crypto messenger for geeks (who were excited by new crypto – I know, I know – and promises of end-to-end encryption everywhere coming some day) to just another messenger with cool stickers and stuff.

Really sad because I personally recommended it too, and was hoping these things would work out somehow. Lesson learned: they don't. The next messenger I will promote with my friends would be one without the server at all.

Endlessly• 6 years ago

This is not a trend, it’s a long standing market strategy:

https://en.m.wikipedia.org/wiki/Embrace,_extend,_and_extingu...

leafmeal• 6 years ago

Can't it be both a trend and a marketing strategy?

soulofmischief4• 6 years ago

Keybase packed together many different technologies in one place. I don't think any of us who moved to Keybase had delusions that it would be around forever. But it's an amazingly comprehensive suite for its small scope and the open source product that replaces it will only exist because Keybase existed.

If the writing is placed on the wall (the marker cap is open right now) then replacing each of Keybase's features with existing technologies won't be difficult -- just time consuming, which is why they have market fit.

qaisjp• 6 years ago

Indeed. We always knew that Keybase would have to find a source of income someway, get bought, or shut down.

notatoad• 6 years ago

on the other hand, it was actually usable by somebody who isn't a privacy advocate.

the trend exists because "pretty UIs" and usability are actually valuable features to users, and the existing open ecosystems tend to fail at that aspect.

rvz3• 6 years ago

Ultimately Keybase's future is in Zoom's hands

Well, that definitely translates to uncertainty and ultimately the death of Keybase.

DyslexicAtheist2• 6 years ago

from Zoom's twitter:

"We are excited to integrate Keybase’s team into the Zoom family to help us build end-to-end encryption that can reach current Zoom scalability."

not a word about what happens to the existing technology which doesn't sound very reassuring to existing keybase users.

chrisma02• 6 years ago

This is a good point. As far as I understood, Keybase's main offering, i.e. key discovery for accounts you knew little about, was never about "the best crypto that scales to Zoom levels".

Though what the main features were got very muddled anyways, especially with the odd Stellar cryptocurrency wallet implementation. I'm very interested to see what they do with the existing tech, or whether there will be open-source forks that are somehow compatible.

tobylane2• 6 years ago

@Keybase users: Check if you uploaded your private key. I hope it is rare but now is the time to make that non existent.

ocdtrekkie• 6 years ago

I essentially didn't have a private key prior to Keybase, and I think it's still the only place I use it, so I'll end up rolling a new one if Keybase becomes fundamentally untrustworthy.

neltnerb3• 6 years ago

I signed up so long ago that I'm not quite sure what you mean. I remember posting a bunch of public keys (like on my profile here). I think the keybase app generated them along with a private key but it has been like three years.

I don't remember at all uploading one or where to find it if I did, can you explain the issue you have in mind a little more?

api2• 6 years ago

I saw that coming when they shoehorned a pointless cryptocurrency that nobody uses into it.

tobyjsullivan• 6 years ago

It was actually a really nice stellar wallet implementation. A bad bet perhaps, in hindsight. Unfortunately, this acquisition means I won’t be using it anymore for the foreseeable future.

stevekemp• 6 years ago

I deleted my account when the crypto-spam emails started to arrive.

DCKing• 6 years ago

People are expressing they will stop using Keybase because of this. That's fine, probably a good idea.

But reading this, Zoom+Keybase will make sure of this themselves. This press release indicates that this is a 100% acquihire. There's only talk about what the Keybase people will be tasked to do, and there isn't any talk about Keybase's services in the first place. There's no real reason Zoom would be interested in keeping Keybase's services up and running anyway.

Let's hope they make it a swift death. Shame about Keybase, loved using it so far. It's somewhat encouraging to see a change in direction for Zoom, too. Hope the acquihire works out.

SirensOfTitan• 6 years ago

This sounds like an acquihire, or am I reading it wrong? If so, I doubt anyone at keybase is necessarily thrilled about this.

I’ve enjoyed keybase for many years, it made a lot of annoyances of encryption and key management easy. I particularly liked its encrypted git repo feature—now I’m struggling to think of an easy alternative.

hnarn• 6 years ago

I've used Keybase for a long time but I never quite understood the purpose of it. It never "just worked" for me and my experience was mostly chats being unreadable, my account having to be reset, and a lot of new functionality that seemed like it did what other products already did, just not as good.

I always liked the idea and the people behind it seemed like good people, but I'm sad to say I won't miss a worse version of Slack, Bitcoin and Dropbox.

kylehotchkiss• 6 years ago

Keybase was cool tech that for years I hoped would find a profit model and more everyday use case. I liked being able to prove I was in control of something on the web. I use Zoom for work and think it's been one of the more stable video conferencing solutions out there but I certainly can't trust them to maintain something like Keybase in a secure manner. Bye keybase, I know you had bills to pay and that this is a tough economy :( I hope your core team will be able to regroup after cashing out at Zoom with some new projects!

Xophmeister• 6 years ago

No thanks... Cheerio, Keybase

mfer• 6 years ago

What are the best alternatives to Keybase?

I'm curious about the encrypted filesystem, secure messaging that works on computers (non-phone), and public key trust.

nathcd4• 6 years ago

Mergers and acquisitions make me so sad :/ I need to stop letting myself get excited about VC funded companies, because it always ends in disappointment. I really should know better by now!

dcow13• 6 years ago

Honest question, why does Zoom’s security reputation matter more than Keybase’s? There’s so much pessimism in here but I really don't get it. I disliked zoom long before any of the security issues because frankly it’s rough, unpolished, software that’s never really worked well for me. I, for one, would be excited to get a functional Zoom with better security integrated into Keybase as an option for UI so that you have a serious “productivity” app. Why does the fact that zoom needs help in the security department automatically spell the end of times?

coldpie9• 6 years ago

What I want is PKI that works for real people. Keybase was trying to be that, and I was really excited about it. But, that's not what Zoom is selling. So Keybase being acquired by Zoom means what I wanted is dead.

dcow13• 6 years ago

Thats fair. And it‘s a much more interesting discussion IMO. Why is Keybase only really used for chat? I mean you can `keybase pull` all your friends’ pgp keys into your local keyring. It’s way way better than reading off fingerprints at a key-signing party. And yet that still didn't lower the barrier enough for people to actually use crypto for shit. Maybe the key is email. Maybe Keybase missed an opportunity to bring email into the equation so everybody could do “web stuff” backed by social pgp without a second thought.

thecureforzits• 6 years ago

Rough and unpolished, perhaps... but zoom is super popular because it's dead simple and gets the job done, and all the big players could learn a lot from them about putting end users first and not trying to leverage them just to push other products. To me the only question is whether Zoom will screw it up by emulating the mistakes that the big players have made.

SamBam• 6 years ago

Yes to all this.

I've been juggling a lot of meetings between Zoom and my kid's school on different platforms, and the difference between Zoom and Google Meet is night and day. Schools are mostly switching to the latter because of the security concerns, but damn is it terrible. It's like Skype from 15 years ago.

floatingatoll3• 6 years ago

The missing piece here isn’t a factor driven by technical logic, but a factor by human logic.

It was “cool” to use Slack until it became widely used, and then it was “cool” to use Keybase instead. Zoom is currently seen as “uncool” (E2EE screwup + widely used), so when they purchase “cool” Keybase, now Keybase automatically becomes “uncool” as well and people will look for something “cool” to migrate to next.

This isn’t a complete explanation of all possible reasons, but it’s absolutely a contributing factor.

EDIT: I predict Riot/Matrix will be the replacement “cool” for Keybase.

0x8BADF00D• 6 years ago

Keybase was useless for the most part anyway. It became a vehicle to airdrop and shill shitcoins. Anyone saying it was some kind of bastion of user privacy is being overly nostalgic.

vz8• 6 years ago

Just out of curiosity, what was it about Zoom that never worked well for you? I work with oodles of academics, and that was the singular reason they flocked to Zoom - out of box ease of setup / ease of use that trumped WebEx and GoTo Meeting.

Privacy considerations were secondary and only came to light (from their perspective) during the increased scrutiny brought during COVID-19.

dcow13• 6 years ago

Their client software locks up my machine every other day. You can’t screen share on wayland. My coworker can’t run a build while on a zoom call or his machine just dies. The UI has never scaled properly on my displays. The zoom icon is distorted in my task switcher. You can’t use zoom in the browser. It’s a lot of little things that add up. I’ll admit I’ve never used zoom on Windows. Perhaps they've invested most of their effort on that platform. And credit where it’s due, when the video calls work, they work as well as any.

ibejoeb• 6 years ago

One scenario in which Zoom's rep matter more, to me, is that they keep keybase alive, but now Zoom's slop infiltrates keybase.

In one way, good job Zoom for looking into security. In another way, I'm still looking at this awful UX that's buggy as hell and thinking it's gonna be a real slog for the keybase team to overcome that momentum.

dredmorbius• 6 years ago

Keybase is sitting on a potential vidconf goldmine heading to our brave newcov world. Keybase was sitting on top of a VC flush trapdoor opening to the abyss.

Tech doesn't matter nearly so much as market. Marrying better tech chops to better market potential is a rather better investor storytime.

(Doesn't mean it'll work, doesn't mean Keybase tech will, or won't, survive. But the plave to be is Zoom's niche with Keybase's clue.)

Infinitesimus• 6 years ago

Honest question, why does Zoom’s security reputation matter more than Keybase’s?

Because Zoom is the buyer and they have the power. Sellers can make whatever promises they like (see: Whatsapp, Instagram) and it is reasonable to assume the buyer will have their way in the end.

Zoom will certainly use Keybase to improve their security overall. However, the rather obvious lack of commitment to existing users means there likely won't be any longterm.

My prediction: Zoom integrates well with keybase, there's a blog post that keybase is shutting down external services in a few months, the keybase founders leave and 1-2 years later, we hear of a new company they've founded.

_lbaq• 6 years ago

Mixed feelings, Keybase could become a "modern" Skype, but it may be the zoom is not that interested in the chat/teams/fs parts of Keybase...

p0llard2• 6 years ago

Oh wow, I had a guest lecture from Max Krohn yesterday in which I asked about how Keybase was being funded; no mention of this at all!

lexicality• 6 years ago

Possibly because of the confidentiality agreements everyone signs at the start of an acquisition?

p0llard2• 6 years ago

I'm sure, I just found it amusing that it comes so soon after I directly asked about it!

floren2• 6 years ago

I've found kbfs a very convenient way to share files with collaborators. Anyone know of a self-hosted encrypted remote filesystem that might replace it?

ajb• 6 years ago

This. In fact I've found it pretty useful just for just personal files.

There's Tahoe-lafs, which ahs been around for years but, although secure was originally pretty notorious for being hard to use. Maybe it's improves since...

gnu• 6 years ago

There is tahoe-lafs. Give it a try.

Arathorn12• 6 years ago

It's kinda ironic that Keybase disappears into Zoom the day after Matrix/Riot enabled end-to-end encryption by default, with cross-signed device verification similar to Keybase's concept of connected keys - see https://blog.riot.im/e2e-encryption-by-default-cross-signing....

In other words, a fully open source (and open standardised) alternative continues to exist in the form of Matrix.

[disclaimer: project lead for Matrix]

ryukafalz2• 6 years ago

Hi! I use Matrix a lot, but a privacy-sensitive group of my friends recently switched to Keybase largely due to the per-room/per-message retention policies. This might be a good opportunity to convince them to jump ship, and I know something similar has been in the works for Matrix, but do you know where it is on the list of priorities?

(Congrats on the cross-signing release though, it's been a long time coming and it's been working really well!)

Arathorn12• 6 years ago

We've had per-room/per-message retention policies in Matrix for months now (although Riot hasn't exposed UX to configure them yet, as we were drowning in cross-signing work).

https://github.com/matrix-org/synapse/blob/master/docs/messa... has the details.

Semaphor• 6 years ago

Hijacking this: Does anyone know if there’s a Matrix client (out or in dev) that has the UI/UX of old 1on1 messengers (ICQ, MSN) and not chatrooms (IRC, Slack)? Specifically not the weird list of bubbles on the side, but instead a list of accounts/rooms and a window per chat.

RMPR4• 6 years ago

I was about to complain about your desktop Electron app but it seems that spectral[0] is already usable without any hassle (build from source, ...) at least on Fedora, time to reactivate my Matrix account, keep up with the great work

0: https://gitlab.com/spectral-im/spectral

roblabla2• 6 years ago

There's also Fractal[0] which uses GTK+ instead of Qt, and is maintained by the Gnome foundation and planned to be used by the Librem 5 AFAIK.

[0] https://matrix.org/docs/projects/client/fractal

Hitton• 6 years ago

Alternatively Mirage[0] - Qt + Python. There is really a lot to choose from with Matrix. The beauty of open protocol.

[0] https://github.com/mirukana/mirage

gnufx2• 6 years ago

But unfortunately these alternatives don't have the same encryption support, do they? (Some seem not to have any.)

packetlost• 6 years ago

Matrix and Keybase have entirely different goals and functionalities. There's barely any feature overlap besides end-to-end encrypted messaging, but it's not like XMPP hasn't had that for years. I think it's silly to even compare the two

Legogris6• 6 years ago

I've been looking into Matrix as a "personal IM bridge" and I'm thinking this could be a way for Matrix to get traction.

Let's say you're in a position that I think may here are: You would prefer to use IM in a secure way. Let me qualify "secure" for this purpose meaning: Encryption of communication in rest and transit; not relying on a single infra/network/service provider; being able to communicate with new peers easily without having to sign up with new providers; not requiring sign-ups leaking PIIs such as phone numbers; being able to sync message history across devices; all of this should hold for group conversations.

matrix.org seems to be on the right track towards that. Feature-wise there's some missing pieces in terms of federation but the roadmap looks like the ambition is right.

But in practice, it's realistically years until you can meet a random person in a bar and ask to join you on matrix to stay in touch, so many of us will still keep our accounts on the not-as-great platforms such as FB, Skype, WhatsApp, Signal.

Given that, wouldn't it be nice to facilitate using those platforms in a way that 1) absolves you from the behavioral tracking that comes with most of the first-party web- and smartphone apps and 2) integrates them in the same UI?

There are, of course, solutions to this end. Bitblbee (IRC gateway), libpurple (pidgin, finch), third-party clients like franz. I'm sure there are many here who have or are using libpurple or bitlbee for this.

But matrix also has bridges!

I'm thinking one potential way that matrix could really get traction and seed the network infrastructure would be just that. Given stable gateways for the IM networks people already use, it's suddenly a much easier sell to get enthusiasts and power-users to self-host matrix servers just to solve their own bridging needs and get a unified flow for disparate protocols.

As that grows, eventually there's a large spread-out flora of matrix servers that can become part of something larger.

I think if there's one thing that can make matrix succeed in it's mission, it's stable, feature-complete (or at least ticking the important boxes for the majority) bridges to mainstream services such as Facebook, Whatsapp, Signal, LINE, Skype, Google and Keybase.

I think this should be a focus for Matrix, and amazing it would be to have these be the fruit of voluntary contributors, some funding is likely required if it's to be sustainable as proprietary protocols and endpoints will inevitably break.

What's your take on that? I realize it's a long comment and I'm in a bit of a rush, but I'd be really curious to hear how you think about these things.

toyg• 6 years ago

I'm not Arathorn (and not even a Matrix user yet, barely ever on Signal too), but the problem with bridges to 3rd-parties is that you're effectively allowing these non-Matrix users to keep doing what they're doing, instead of incentivising them to switch. The walled gardens know this very well - that's why they've discontinued their XMPP gateways.

Arathorn12• 6 years ago

We're working on making bridges better integrated in Matrix to help with this use case - it's certainly a good way to drive uptake.

On the other hand, bridges are always an impedance mismatch - you have to keep up with new features on both side of the bridge, and the system you're bridging into doesn't always want to be bridged.

So, we think bridges are a key thing for Matrix (it's where the name comes from - matrixing together different comms platforms!) - but it'd be wrong to predicate the success of the protocol on bridges. They're useful, they have their place, but they're not the sole reason to use Matrix.

KAMSPioneer2• 6 years ago

Holy crap, the Matrix/Riot teams have been busy! Congrats on the progress, it's very exciting to watch. Although I have a Matrix account I have had trouble getting friends/family to switch with me (mostly non-technical folks, and Signal was much stickier for them), it might be time to convince them to try again.

Thanks to you and the team for all the hard work!

mikro2nd• 6 years ago

Interesting. I've turned quite a number of non-technical friends/family into Signal users, just by telling them, "Here's the messaging app I'm using if you want to talk to me..." without mention of encryption until they're already hooked. Uniformly comments have been favourable concerning ease-of-use and quality of voice/video calls (at least compared to what they're already used to -- generally Zoom or Skype), and several of them have pushed it out to their networks in turn.

seemslegit5• 6 years ago

What endgame do you think your company has other than eventually selling out its userbase in one way or another ?

Arathorn12• 6 years ago

Matrix isn’t a company, it’s a non-profit foundation, expressly set up to protect its users: see https://matrix.org/foundation for details.

Riot is a Matrix client made by New Vector (https://vector.im), the company started by the team who originally created Matrix. The endgame there is to sell Matrix hosting (https://modular.im), support and other value-added services for Matrix. We are categorically not going to sell out our userbase - and we have no reason to; if we did, they’d just move to a different Matrix service provider.

zfnmxt• 6 years ago

It's funny, but I think I get most of my Riot/Matrix news from your comments scattered about hacker news.

Anyway, I run a matrix server for my family (and we all use the Riot client) and the number one issue is encryption and mysterious "Unable to Decrypt" messages. (Closely followed by how rough the Android client is.) This fixes all of that (well, once RiotX replaces the standard Android client) and I think it will remove a lot of friction.

Thanks for your work!

eslaught2• 6 years ago

The thing I like about Keybase is that keys are always generated client-side and never leave the client, and all of the functionality associated with adding/removing devices is done in a way so that there's no way for a server to tamper with it (aside from denying service).

Is that true in Matrix? Several services advertise themselves as "end-to-end" encrypted, but then when you poke harder it turns out either there is some sort of TOFU (so an opportunity for the server to insert itself) or else there is no device continuity (which means in the case of e.g. Whatsapp that keys are reprovisioned almost promiscuously to avoid bad UX). Whatsapp is a particularly bad example because (a) I lose chat history when I move devices, and yet (b) the UX does not require an old device to authenticate the new one, so I can compromise conversations (at least moving forward) if I can compromise a server.

How end-to-end is Matrix really, and how similar is the new support to Keybase's key management flow?

Arathorn12• 6 years ago

Yes, Matrix is properly end-to-end encrypted (with all keys generated clientside) and has been independently audited as such: https://www.nccgroup.trust/us/our-research/matrix-olm-crypto.... We have gone to huge efforts to prevent MITMs via device verification and cross signing - which specifically addresses both problems of a) losing chat history when you move between devices (via https://github.com/uhoreg/matrix-doc/blob/e2e_backup/proposa...) and b) requiring cross-signing when you log in on a new device, to spread trust to new logins, as per https://github.com/uhoreg/matrix-doc/blob/cross-signing2/pro....

All keys are stored clientside, with the exception of if you enable serverside key backup, when they are then encrypted and optionally stored serverside to allow you to recover your history if you lose all your devices.

jrochkind1• 6 years ago

From the headline, I didn't understand why Zoom, a videoconferencing company, would want to buy a secure messaging/sharing app.

But after reading it, duh. It's an acqui-hire. Zoom definitely needs to improve it's security, because of recently publisized problems. These are the right people to work on that, the security problems are similar in keybase and zoom, and an outside team with an established track record will help Zoom regain credibility. And Zoom probably had lots of cash on hand to buy whatever they wanted.

So that all makes sense. I wouldn't expect the keybase product to stick around though.

Not because, as other commenters had said "Zoom doesn't care about security." Because they did an acqui-hire to get a team to help them with security, not because they wanted the product. I expect this will result in Zoom's own security improving, it's not some kind of smoke and mirrors trick. It's not that they don't care about security, I think they are presently prioritizing it. They just don't care about the keybase product. Obviously, why would they? It can't have revenue or profit anything close to what the zoom product has.

pot8n• 6 years ago

Keybase went from ranking 30,000 to 65,000 in 3 months. What happened here? It seems like Keybase has been falling in traffic already for the past 3 months and it's reputations has been tarnished in HN for months now.

https://www.alexa.com/siteinfo/keybase.io

RL_Quine• 6 years ago

The product is simply not good in its current form. It's a strange mix of instant messaging, web of trust, and cryptocurrency scam. It doesn't strongly give any particular goal. The tools are shiny, pleasant enough to look at any use, but isn't going in any direction.

A lot of push recently has been into making it a "team chat" platform, which is great except that all of the participants are public, and tied to their name. It makes for hideously bad opsec if any company were to seriously use it.

coldpie9• 6 years ago

God, that cryptocurrency scam. If ever there was a clear message screaming "we have no idea how to turn this into something profitable/sustainable," that was it.

ValentineC4• 6 years ago

It's a strange mix of instant messaging, web of trust, and cryptocurrency scam.

They ended their Stellar airdrop early, but I guess it didn't help that bots were joining the platform, and affecting the other parts of the Keybase community, just to get a share of it.

freakynit• 6 years ago

Is there a viable alternative to keybase?

jklinger410• 6 years ago

Engineer: Sir, it would be easier to just start over and build a video app for security from the ground up.
CEO: But that would cost millions over the course of years!
Engineer: Or we could just buy an already secure video app and put our features inside of that instead?
CEO: Genius!

And that's how Keybase became Zoom.

sealthedeal2• 6 years ago

NOOOOOOO!!! I am going to miss Keybase

andrewla• 6 years ago

On announcing that they'll support git [1]:

> > You guys should be taking my money
> One way to pay, if you want to help ensure their success & longevity, is to evangelize for them, and get other people hooked on their product. Getting other people hooked on it like you are and seeing the potential and get over the adoption humps... that's valuable! They're not taking money because it raises the barrier to entry, and growth is most important. Pay them by helping them grow.
It's valuable, but not in the capital sense. Each person you get hooked on their product increases their burn rate, and both makes them more attractive as an acquisition (which is scary for users) and more desperate for cash (which makes acquiescing to acquisition more tempting).
Without a road to profitability (or at least a road to revenue) even attracting equity is difficult; investors who enter with that knowledge will be looking to exit through acquisition, since that's basically the only way to exit, other than just getting more capital.

[1] https://news.ycombinator.com/item?id=15403772

Legogris6• 6 years ago

I recently posted this comment during a recent Keybase/Keys.pub thread: https://news.ycombinator.com/item?id=22996981

Looking forward, none of that seems to matter due to this acquisition/acquihire - it seems clear that we'll not be able to count on Keybase in any meaningful way from now on.

This is the most disillusioning acquisition to date for me.

juskrey• 6 years ago

Looks like a bad PR stunt. One does not need to acquire another firm to implement direct secure video channel.

crazygringo2• 6 years ago

Everyone here saying Keybase is dead... why hasn't anyone mentioned that Keybase is open-source? New BSD (3 Clause) License. [1]

So regardless of what happens to it with Zoom, the community can fork it and continue developing it, no?

So if people don't want it to be dead... it's not dead. That seems like great news, right? (And great foresight?)

[1] https://keybase.io/docs/the_app/source_code

eropple• 6 years ago

The backend isn't open-source, AFAIK. It isn't a full reverse engineer job to implement that, but it's not trivial.

coldpie9• 6 years ago

I know we all like to pretend it's all passion projects, but the reality is that with very few exceptions, developing large-scale, end-user-ready software costs money, regardless of the license. If devs aren't getting paid, they're not going to work on it. Keybase is dead.

wink• 6 years ago

Despite being one of the earlier signups I have never fully grasped what it's actually good for.

Time and time again I forget about it and when I check the website it seems to be doing something different - but it all sounded very centralized, first the gpg keys, then the file-sharing and chat - it doesn't seem to be federated.

So unless some entity steps up as the de-facto api-compatible replacement, I don't see how having the code alone would help, unless you want a chat solution for a handful of users?

627467• 6 years ago

I can't help but feel shocked by this development. I guess it's my fault given that keybase was always potentially a target for acquisition.

PR-wise it does not seem to bode well for those who relied on it for both file, chat and social graph storage...

albybisy• 6 years ago

and what about the partnership Keybase had with Stellar? What are destiny of all the lumens XLM they had...??

mikaelf• 6 years ago

zoombombing just got another meaning

defulmere• 6 years ago

Wow, it didn't take them long to dumb down https://keybase.io - no mention of all of the cool nerdy crypto stuff, git, etc at all, now it's just another chat app.

corkscrew• 6 years ago

It's been like this for weeks

technick• 6 years ago

This is why we can't have nice things! Be sure to transfer any crypto out of keybase now before its too late.

jononomo• 6 years ago

I think this is fantastic news. I expect adoption of both Zoom and Keybase to increase as a result of this partnership. I love both these platforms and this feels to me like a really perfect match. I'm so glad that people aren't going to be forced to use Google and Microsoft for everything -- it is good for monopolies to be challenged with innovative tech.

anigbrowl• 6 years ago

Good thing I already finished my coffee before seeing this headline. With no disrespect to Zoom, who might even have the best intentions, seeing Keybase just get acquired spooks me, and makes me glad I wasn't seriously invested in it. I had been under the impression (as a very casual user) that it was using a foundation finance model to ensure its independence.

smolder• 6 years ago

This is hilarious to me, because I finally decided to make a keybase account and start making use of their service two days ago, and today it appears to be a dead product.

nyxtom• 6 years ago

Well that's disappointing

jchw• 6 years ago

Why? This doesn’t even make sense.

Now I don’t even know if I can trust Keybase, and am trying to figure out if I should delete my account. Does anyone have any persuasive arguments for/against?

upofadown• 6 years ago

We believe this will provide equivalent or better security than existing consumer end-to-end encrypted messaging platforms...

So it will be harder for us to get at your stuff than is is presently, but we will still be able to if we bother to do the work.

We are also investigating mechanisms that would allow enterprise users to provide additional levels of authentication.

So they will offer completely secure communications if you are at the paid level.

wadkar• 6 years ago

Congratulations to the keybase team.

Most people here seem to be making a self fulfilling prophecy of keybase's death.

But I like to think that Zoom intends to reuse large parts of keybase codebase:

Logged-in users will generate public cryptographic identities that are stored in a repository on Zoom’s network and can be used to establish trust relationships between meeting attendees. An ephemeral per-meeting symmetric key will be generated by the meeting host. This key will be distributed between clients, enveloped with the asymmetric keypairs and rotated when there are significant changes to the list of attendees. The cryptographic secrets will be under the control of the host, and the host’s client software will decide what devices are allowed to receive meeting keys, and thereby join the meeting. We are also investigating mechanisms that would allow enterprise users to provide additional levels of authentication.

Will the founders be interested in releasing parts if not all of the server code to the public? I believe the founders' mission is still achievable and can be carried out, should they be willing to release the code in public.

BERTHart• 6 years ago

And I just started to use Keybase 3 days ago...

koirapoika• 6 years ago

Zoom?! What a twist! Congrats to the Keybase team! Although it's time to drop the account and move further, I'll keep it for a while in case of another twist.

sneak4• 6 years ago

So, the company that got bribed by a shitcoin promoter to backdoor the keybase app so it can abuse your secret keybase identity keys to place permanent, non-removable shitcoin ads on your profile[1] (and then immediately denied that it was a backdoor and also lied about implementing the ability for users to remove the ads keybase got paid to place[2]) is now joining up with the company that has shipped sketchy backdoored client software[3], consistently lied about having end to end encryption (and even doubled down on their lies when confronted about it!)[4] and delivers their encryption keys from generation servers in China[5].

I'm sure the result of this will be lots of good and secure trustworthy software that I'll be eager to install on my computer. It's totally legitimate and accurate that people are reporting today that this acquisition will bring real end to end encryption to Zoom as if buying a company causes software to spontaneously manifest out of the ether with zero delay. Don't worry, everyone: Zoom is secure now because they wrote a check!

What is it with cryptographic charlatans these days?

[1] https://sneak.berlin/20190929/keybase-backdoor/

[2] https://news.ycombinator.com/item?id=21109530

[3] https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

[4] https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-...

[5] https://www.forbes.com/sites/thomasbrewster/2020/04/03/warni...

plttn• 6 years ago

1: it wasn't a backdoor 2: it wasn't a backdoor

yarrel4• 6 years ago

RON HOWARD VOICE OVER: It was a backdoor.

technoplato2• 6 years ago

After reading part of [1], I have no idea how you draw the conclusions you do.

I was playing around with a bunch of different crypto currencies when Keybase did the airdrop with Stellar. At every point in the process, it was opt in. Then I received ~$60 and that was it.

It seems your article was going for sensationalism and was highly disputed by all commenters on HN, not covered up by some capital driven conspiracy.

BillinghamJ• 6 years ago

I'm pretty sure I ended up receiving a load of XLM without opting in at all.

ViViDboarder4• 6 years ago

From your second link a commenter actually steps through the flow: https://news.ycombinator.com/item?id=21116981

It seems pretty clear from that description that the user consents to signing...

I think it’s annoying to see wallet and chat when all I really cared about was a discoverable public key, but it doesn’t appear to be a backdoor signing method.

avree• 6 years ago

The guy you're replying to is the one who wrote the misleading blogpost that was (rightfully flagged) in link [2]. I think it's likely that if he's still grinding this axe 7 months after a very reasonable explanation was given by Keybase, he's not going to change his mind now.

sneak4• 6 years ago

No, the consent modal is for generation of the wallet keys. It says nothing about the fact that if you agree to make a wallet, it will then use your keybase identity keys (different keys, not the shitcoin keys you consented to generate) to sign the attestation and permanently affix the resulting ad for Stellar to your profile.

dang4• 6 years ago

Please don't post in the flamewar style to HN. We're here for curious conversation, not to smite enemies, snark, score rhetorical points, and whatnot.

Also, if you ratchet rhetoric up to this level of indignation, you detract from your own credibility, so it's not in your interest.

https://news.ycombinator.com/newsguidelines.html

sneak4• 6 years ago

My apologies; I thought it was on this side of the line, if a bit sarcastic. I do my best to comply with the guidelines and keep it on topic here.

Please delete/kill the comment, it’s actually irrelevant because their old product is probably toast now (as is implied in TFA). My delete button timer has expired.

sealthedeal2• 6 years ago

I was one of the early Keybase adopters/users, this is kind of a sad and happy day all at once. I am happy for the founders and team as this is a great exit, but am sad because I think Keybase, one of my favorite products, is going to go to the wayside :(

tfranco• 6 years ago

They spelled aquihire wrong.

JensRantil• 6 years ago

Seriously, is this an April Fools' joke?

gumby• 6 years ago

Many are bemoaning what zoom will do with Keybase, but the code is bad licensed so nothing’s stopping anyone from forking the repos now and building a parallel distro.

Realistically this is probably the best outcome for the Keybase team as they presumably have jobs for the foreseeable future.

zanderz• 6 years ago

The server was never open source and that will be a pretty big obstacle to the product living on beyond the company. That and maybe the Amazon S3 bill.

HashThis• 6 years ago

Please open source keybase

crad• 6 years ago

Well that sucks. I'm glad they got an exit. I won't be using them moving forward due to trust issues with Zoom.

ammmir• 6 years ago

Keybase was almost the perfect Slack-killer for security-minded teams, except it had a few wiggles, including their sluggish client. I believe there is an opportunity for someone to capture the users who are about to be abandoned by this transaction, if they implement a subset of the Keybase client functionality like team chat, shared files/git repos, but get rid of the crypto wallet nonsense. I, and others, would gladly pay $10/mo for this.

Matrix isn't the answer. That's like saying just use SMTP for email.

The slackification of Keybase did not lead to a viable business model, unfortunately. In fact, it's such a no brainer, I can't wait for someone to build Keybase 2.0. It might not be a VC enterprise, but could be a great lifestyle business for a small team.

justusthane• 6 years ago

In case it's helpful to anyone, to uninstall on MacOS:

  # keybase uninstall

And then delete the app from Applications (recommend using AppCleaner to delete the app, as it leaves behind almost a GB of stuff).

danrl• 6 years ago

Congrats to the team for having a nice exit. I myself removed all my data from keybase und stopped using it. There is just no trust left on my side for Zoom and those who join Zoom in a business relationship. Indistinguishable from malware it has been for me. Disrespectful of my privacy and hard to remove from my machine. No, thanks. Nevertheless, wishing all the best for keybase.

whateveracct• 6 years ago

This is kind of comical - I guess when leadership-types want to recover from the recent bad press, they decided they could buy a security-oriented company and that'll "help make Zoom more secure." I guess what more can you do when you can't implement this stuff lmao

pkilgore• 6 years ago

You can put lipstick on an aqui-hire, and it's still an aquihire.

dcchambers• 6 years ago

If the main reason for this acquision is for the Keybase engineering talent, I hope Zoom/Keybase does the right thing and open-sources the server code for Keybase, rather than letting the product die.

jtchang• 6 years ago

The negativity here is astounding. This really comes down a company putting their money where their mouth is. Think about the reasons you'd decide to acquire Keybase. It certainly isn't for PR as most people have no idea what Keybase is.

What we are seeing is that Zoom is truly concerned about how their security posture is hurting their business. Remember they aren't the only game in town and there are plenty of competitors. Buying Keybase is an investment in their culture and longterm outlook.

throwawaygo• 6 years ago

Best thing they could have done. They purchased expertise and a brand that is untarnished and loved in security circles.

decebalus12• 6 years ago

a brand that is untarnished and loved in security circles.

It was just tarnished and unloved. Got notified this morning that I won't be able to access the public files of most of my 'security circle' on Keybase because they deleted their accounts.

crazygringo2• 6 years ago

I couldn't agree more, and am disappointed that your comment is (right now) apparently quite downvoted. Zoom deserves credit for what they're doing. It's fine to reserve final judgment until we see how it all plays out over the next couple of years, but these are extremely good signs that Zoom is implementing a massive turnaround in security.

yarrel4• 6 years ago

I am a Keybase user.

I am disappointed by Keybase's impending doom.

If that comes across as negative, it's because it is.

decebalus12• 6 years ago

The negativity here is astounding.

Should it not be? I love Keybase, I've been using it for a long time and it's such an important part of my daily workflow that I would be more than happy to be a paid subscriber. Now it's most likely gonna shut down. I find it hard to find any positivity in this.

ianopolous• 6 years ago

If anyone's looking for a fully open source, decentralized encrypted filesystem similar to keybase fs, then checkout Peergos[1][2]. It's built on top of IPFS.

[1] https://book.peergos.org

[2] https://github.com/peergos/peergos

[disclaimer: Peergos founder]

bad_user• 6 years ago

I like Keybase's encrypted Git repos.

I hope it doesn't die.

ezoe• 6 years ago

"Our existing codebase sucks. So let's buy some cool companies in the wild and let them help fixing our codebase"

Yup, it sounds like the perfect plan to me.

What likely happens is this. The current codebase is too ugly to improve. But since they have a lot of users, it has value. So, the engineers from Keybase started from scratch, try to implement all of the functions in the existing codebase, plus secure. The plan is, after it has been developed, replace the existing codebase. But unfortunately, they miss the planed deadline by years and when it's finally working, they couldn't implement all of the existing codebase because nobody knows how to implement it. No documents and original implementers were left the company long ago. But they spent so much effort on the new project and all the new features are implemented just on the new one. Resulting the chimera of old and new code base both running at the same time. Oh and by that time, the user is rapidly decreasing for they failed to improve the service for years while the competitors offer the better service now.

The same story repeated countless times.

president• 6 years ago

You forgot:

- Acquihired employees end up having zero passion or motivation to work on tech from their new masters and end up doing a crappy job and implementation before their retention period ends and they bail out.

- Mish-mash of additional crap code increases tech debt to a point that alienates top engineers causing them to leave for greener pastures. The second-tier engineers end up taking up the reigns hack band-aid further destroying the codebase. Cycle of crap code and good engineers leaving continues until the company is left with lowest-tier engineers who couldn't get a job elsewhere or desperate H1-B visa holders who hold up the fort until a competitor comes to eat their lunch with a better, more performant product.

soulofmischief4• 6 years ago

I have moved much of my digital life to Keybase. This news brings me much fear but I just pray that Zoom takes the best parts and then allows Keybase to continue to function as a goodwill venture at least until a suitable replacement appears. The software package Keybase offers is unbeatable.

brynet• 6 years ago

You can permanently delete your keybase.io account with the command-line utility:

    $ keybase account delete

mike-cardwell• 6 years ago

Eurgh. Time to transfer out my XLM and find some other way to handle my private git repos.

paramk• 6 years ago

Will this mean Keybase will be killed in the near future ?

From the blog

Initially, our single top priority is helping to make Zoom even more secure. There are no specific plans for the Keybase app yet. Ultimately Keybase's future is in Zoom's hands, and we'll see where that takes us. Of course, if anything changes about Keybase’s availability, our users will get plenty of notice.

So, our shortest-term directive is to significantly improve our security effectiveness, by working on a product that's that much bigger than Keybase. We can't be more specific than that, because we're just diving in.

conroy• 6 years ago

Will this mean Keybase will be killed in the near future ?

Absolutely. This was clearly an acquihire.

I copied all of my data out of my keybase folder today and I'd suggest you do the same.

alwillis• 6 years ago

I woke up this morning and read this and literally thought it was a belated April fool’s joke or something.

Best case scenario: the Keybase app gets spun out and gets an appropriate home.

gonehome11• 6 years ago

For years people have been begging Keybase to allow them to pay them for the service and Chris Coyne always refused.

Now they've lost their independence and they're owned by a communication company that has [edit: the majority of] its dev team in China.

I use Keybase to talk to my friend in China since it's one of the few services they don't block.

This is a pretty disappointing outcome.

bgee3• 6 years ago

communication company that has its entire dev team in China

citation needed

Also, what are you trying to imply by this assertion?

gonehome11• 6 years ago

"Zoom is based in California’s Silicon Valley, but it owns three companies in China that develop its software. The Citizen Lab said the structure allowed the company to lower its development costs, but added “this arrangement may make Zoom responsive to pressure from Chinese authorities.”"

https://www.theguardian.com/uk-news/2020/apr/24/uk-governmen...

The implication is that China is hostile and leverages their power to censor/collect communication information from companies and their people without checks on this power.

They are aggressive in stealing IP from other companies and blocking software they can't control. They have history of wielding their power to pressure organizations to deny or ignore aspects of their history that they dislike (Taiwan, Cultural Revolution) and they pressure companies to hand over PII on people they find to be political threats without due process.

This is not a country you want to be a steward of an encryption identity standard.

aaomidi• 6 years ago

China is a country with even less oversight than the US.

For a company that does security that's concerning.

kyrra• 6 years ago

Another citation: https://investors.zoom.us/static-files/09a01665-5f33-4007-8e... (warning, PDF)

We also operate research and development centers in China, employing more than 700 employees as of January 31, 2020.

You can find more stories from last year talking about that was how Zoom had such a large engineering staff, is that it was cheaper for them to pay for R&D in china than in the US[0].

[0] https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...

poofyleek• 6 years ago

Very disappointed indeed. Keybase is one of the ones I actually used.

pmorici2• 6 years ago

There was a competitor app that got posted here a couple weeks ago.

https://keys.pub/

mikorym• 6 years ago

It is funny that Zoom was one of the companies that I flagged in my head as the worst (or rather, most dangerous) up-and-coming tech company and I considered Keybase one of the most promising up-and-coming tech companies.

Keybase solves a (to me) nontrivial problem: How to bring private keys into social media. Just a silly example: You don't use the same private-public key exchange in Whatsapp as you would use for your emails, or to sign your packages. It's a bit of the now infamous Dropbox situation: Most people can sign things with private keys and properly keep track of it, but they don't get around to doing it. It's only critical cases where the use is common (like signing packages). It took a long time even for HTTPS to become standard practise, though I guess the situation with your browser is a bit different.

freshhawk2• 6 years ago

Yes, this was exactly how I mentally categorized these two companies as well.

My first reaction was: it can't be that keybase can it? Huh, well maybe I'd sell my principles for that much money too, oh well.

Maybe some keybase employee will end up being a whistleblower sometime soon though.

zamalek3• 6 years ago

Zoom was one of the companies that I flagged in my head as the worst [...] Keybase one of the most promising

Hear hear. It really is an absurd world we live in, and I had a good chuckle about that - just before I deleted my Keybase account.

SujiYan• 6 years ago

Have a try of Maskbook.com , ran by our team. I believed this actually solve this problem in a more elegant way.

foobiekr2• 6 years ago

I am curious: do they block Zoom?

Jon_Lowtek• 6 years ago

Well yes but no. The block zoom.us but there is zoom.cn

This is likely related to both nations having rules that allow only their own agencies to wiretap.

tabbott2• 6 years ago

Losing their independence was from the beginning the most likely outcome of building something that's hard to monetize like Keybase on the VC funding model. FWIW, I doubt Keybase offering a paid plan would have raised revenue that's significant compared to their burn, so Chris was probably right to not spend resources figuring out a paid offering. For raising their next round, having $5K in revenue from a paid plan few people buy might well have been worse than having $0.

The VC funding model is terrible for most open source projects. With a few exceptions, you end up with an acquisition that ends or repurposes the project, or an Open Core project. And a VC-funded Open Core project will end up trying as hard as it can to have everyone need to buy the paid version, since that's clearly the way to optimize revenue and eventually the slippery slope will get you there. I don't blame folks for taking VC; it was easy to get, and there aren't a lot of alternative funding models that can pay the multiple fulltime staff that might be required to create what one wants to create.

I don't think VC funding as it currently exists is consistent with running an open source company according to my values, which is why we're not taking venture funding for Zulip. Obviously, being scrappy, applying for NSF grants, and spending my own money have very real downsides both personally and for our growth, especially when every competitor has VC funding, but it also means that I can ensure Zulip continues existing as a real open source project for the long run.

gonehome11• 6 years ago

How much power do the VCs typically have?

Don't founders often have the ability to overrule and make their own decisions?

Chris is already financially independent from the OKCupid sale, he could have open sourced the server code and/or reduced the overall burn to pivot to paid accounts.

Though the weird Stellar wallet addition implied some vision/product issues anyway.

Of course it's easy and probably unfair for me to say these things as an outsider with limited information and no real stake, it's definitely possible I'm wrong about important details that would change my mind. It'd be interesting to hear from Chris, but the sale probably restricts public communication?

This reminds me a little about the OKC sale actually, they had a blog post about why charging for dating sites made them worse that they took down after selling to match (they used to do cool analysis and publish them as blog posts, most of the details ended up in the book a different cofounder published called Dataclysm). That's more understandable to me though since I think it was their first exit.

Reading about Zulip - didn't you get bought by Dropbox before being open source? Is your current situation a lucky outcome - or was it a condition of the sale?

[Edit] - To clarify since there are downvotes, my questions aren’t rhetorical - they’re genuinely asking.

ahnick• 6 years ago

Fingers crossed they open source the server portion at least -> https://github.com/keybase/client/issues/24105

wiggler00m• 6 years ago

alexisgermane• 6 years ago

Interesting. So the question is why doesn't China block it.

mirimir6• 6 years ago

Sad. Very sad. It was such a great approach to associating GnuPG keys with social media. And their chat etc were also pretty cool. But Zoom is beyond the pale.

So what now? Maybe someone could clone the GitHub repos. And/or are GnuPG keyservers safe enough again?

For chat, Session looks most interesting. It's got the Signal messaging bits. Plus anonymity via the Loki onion network. And it's available for all platforms.

However, it's very new, and often buggy. And the Loki Foundation is Australian. So at some point they'll likely get pressured to backdoor stuff. And they probably won't be able to disclose that, unless someone leaks.

There's also Tox, where each user runs a Tor onion client. That's secure enough in Whonix. But the Whonix user base is miniscule, and I wouldn't trust an implementation in Windows. But then, maybe Session in Windows is too iffy as well.

Anyway, I'll be deleting my Keybase account, as soon as I've negotiated alternate comms with my contacts.

namibj5• 6 years ago

So, yeah. Zoom did bad stuff. But Keybase is designed so that all those things would obviously be detectable (Keybase client code is open source), and the ways in which the Server could mess with data are much restricted. If that spreads to Zoom, there's a chance it'd be a good service in a year or two.

PGP keyservers have a fundamental issue that demands a solution like CT logs or Keybase-style merkle trees.

The only way to prevent getting Loki backdoor issues would seem to be a development so clearly in-the-open, that any secretive addition of significant code/suspicious PR behavior is obvious.

Tor does not use Tor by default. It works with Tor, but that's it.

_pmf_• 6 years ago

and Chris Coyne always refused

Well, now he has a thousandfold outcome compared to breadcrumbs that devs would throw at him. I.e. the system worked.

bythckr• 6 years ago

I use Keybase to talk to my friend in China since it's one of the few services they don't block.

I think the vital question is why was keybase not blocked?

Maybe it was owned by someone high-up in China. That is why maybe Chris Coyne refused funding. It was free to just to onboard maximum number of users. Seems like "users" where the products that bought value to keybase.

dreamszl• 6 years ago

You really have imagination.

gonehome11• 6 years ago

Things are usually not blocked when they’re not that popular or well known.

In the Keybase case I think it was just obscure enough to avoid the censors.

ydb• 6 years ago

I am glad you mentioned China. Many people are too afraid to acknowledge the reality of that authoritarian country, for fear of reprisal from liberal do-gooders.

This acquisition is a shame.

erydo• 6 years ago

Congrats to the team. Though in the inevitable acquisition, I wish GitHub/Microsoft had been the acquirer: there are a lot of natural fits between that ecosystem and Keybase's model, and a reasonable history of successful acquisition.

Hopefully Zoom avoids gutting Keybase. I found it really useful for bootstrapping credentials when onboarding remote team members and contractors. Way easier to manage than GPG: it was fairly painless even for non-technical people.

Fingers crossed. I wonder what the infrastructure overhead cost is?

up2isomorphism• 6 years ago

Unregulated capital dominance is current at the historical peak in US. And funny thing is people can not do anything about it. Considering the time where AT&T (which is much more benevolent in today's term) can be broken up, today is just money game and money game.

schoolornot• 6 years ago

Surprised they took the path of acquiring Keybase and hiring Alex Stamos (ex FB CISO) vs. hiring Moxie Marlinspike and other respectable professionals. Keybase's reputation has become eroded with their recent crypto currency signing nonsense.

https://en.wikipedia.org/wiki/Moxie_Marlinspike

rvz3• 6 years ago

Exactly. It was part of their 90-day strategic move in Zoom Security.

From this article: [0]

Within days, Stamos was on the phone with Keybase co-founder Max Krohn, and the teams started working toward a deal. Yuan said after he talked with Krohn and dug into Keybase’s software, he was convinced this was the right deal.

[0] https://www.cnbc.com/2020/05/07/zoom-buys-keybase-in-first-d...

munchbunny2• 6 years ago

Zoom's problems aren't really a matter of having security talent, they're a matter of the company as a whole not prioritizing security. Fixing the former doesn't fix the problem, it just makes for good PR. The latter is a requirement for the former.

Brian Krebs talked about this a bit in the wake of Equifax: https://krebsonsecurity.com/2018/12/a-chief-security-concern...

Assuming Zoom is really trying to fix the problem, it makes a lot of sense to bring in management (and/or teams) who have experience with bringing security into engineering culture, as opposed to individual security experts who may not even want to work for Zoom in the first place.

pianoben• 6 years ago

Another "incredible journey" comes to a close.

What a solid and useful product Keybase was! I'm ashamed that I didn't see this coming. Now I have to find a replacement that isn't compromised.

metreo• 6 years ago

Keybase is dead long live Keybase2!

xoa• 6 years ago

"We're thrilled with the match, and we're excited to be working on security that affects everyone we know."

https://ourincrediblejourney.tumblr.com/

Argh, yet another for the list. Certain cycles in the tech world are both extremely predictable and regrettable, yet for most of them the sting seems to fade a bit as the decades go by. But the acquisition-for-the-talent/IP-now-great-product-is-toast one somehow never, ever manages to lose its capability to be depressing. On the contrary new ones just make me think back on previous dearly departed that never got an equivalent replacement. It's part of what's made me particularly suspicious about new non-OSS "free" offerings, because that's generally just not sustainable. And the better it is the more I beg them to have some sort of decent paid tier. I guess some though just plain are aiming for a buyout from the start and that is in fact their planned profit/exit strategy, and fair enough but still ouch each time.

rising-sky• 6 years ago

I was starting to look at the space of public trustworthy identities, are there any viable alternatives out there that are vouched for in the community?

CalmStorm• 6 years ago

I have been working on this decentralized key-value database: https://github.com/kevacoin-project/kevacoin

Together with W3C's draft Decentralized Identifiers (DID: https://www.w3.org/TR/did-core/), it could provide a decentralized alternative.

Not sure what is the best way to verify Twitter/Github account though. This has to be managed by users themselves. E.g. one user posts a proof in the Twitter account, the other user verifies the proof by checking the proof against the public key posted in the database.

Edit: updated description.

kevinwang• 6 years ago

Huh??

HumblyTossed• 6 years ago

Now if they'll just push that server code to github...

eximius• 6 years ago

Does anyone know if Keybase's data retention policy actually deletes the data if I delete my account?

I don't want to delete it if it is just a soft delete.

lanevorockz• 6 years ago

Would it be great to be link social media accounts to your professional behaviour in Zoom? So we can make sure all your actions are company compliant?

js4• 6 years ago

Why do I feel that this is Keybase selling out?

Zoom seems so off mission for them. Very disappointing.

KingOfCoders• 6 years ago

Oh no.

Havoc• 6 years ago

Well they had better sort out their security ASAP. The South African parliament's Zoom meeting just because a porn stream. Second time that has happened in <month. Can't really see why anyone is still using it for serious work.

https://www.heraldlive.co.za/news/politics/2020-05-07-parlia...

ccktlmazeltov4• 6 years ago

This is actually a really interesting acquisition, keybase wasn't going anywhere yet was producing some really good stuff. On the other hand zoom is a bunch of security and cryptography amateur, I can't wait to see what's going to happen. Good luck!

kemonocode• 6 years ago

Well, I guess that's it for Keybase. I distinctly remember expressing my worries about them spreading themselves too thin and not really having a clear monetization plan, so an acquihire was the easy way out.

Say, anyone got any Keybase alternatives that are focused only on identity management?

stickac3• 6 years ago

https://keys.pub

stickac3• 6 years ago

I am glad we have https://keys.pub/ :-)

stickac3• 6 years ago

I am glad we have https://keys.pub/ :-)

chicombase_io• 6 years ago

Let's be based. This shit is CCPromised. Please dang finest let's this skit stand. Never trusted keybase in the first place

2throwaway44332• 6 years ago

Keybase has been pretty okay with free-speech groups like: https://keybase.io/team/det_disp

I wonder if Zoom will change that or not...

urda• 6 years ago

Well that's it for Keybase. I can't continue to recommend them. I was able to look past the cryptocoin distribution to be honest, but teaming up with Zoom seems like the kiss of death for any security focus.

bergstromm466• 6 years ago

Poor Zoom, first they were scapegoated due to the whole industry’s overuse, or faulty use, of the term ‘end-to-end encryption’ (especially if we believe Snowden’s claims in his latest book that portrays corporate cloud computing as a way for American corporations to create and sustain NSA backdoors). Now the team is probably pretty motivated to kick ass and show the world what they’re made of, considering they have Microsoft Teams, Skype Google Meet and other big co’s as competitors (or maybe it’s the opposite, and Zoom is the bigger NSA Trojan horse here).

jokoon• 6 years ago

There were local, volunteering missions to help healthcare workers, the homeless, etc all done by some "non-profit" in europe. Those missions had state-sponsored ads, and I volunteered online.

As soon as they required me to use zoom, I told them I would not use zoom. I just go on their whatsapp thing, so of course I get less info, etc.

I really fail to understand how Zoom became so popular, and I was recently wondering the same thing about TikTok, which by the way, was just a clone of Vine.

Essentially, with apps like that, advertising and adoption is critical, the tech doesn't really matter that much. I would really be interested in understanding what are the strategies in place to make people use those things. Of course the virus played a huge role, but I'm certain there are specialists about how to gain users rapidly.

baumy• 6 years ago

Can't help you with TikTok or Vine since I don't understand those either (I believe the target market for them is mostly people around age 21 or younger, so if you're outside that group that's not surprising).

For Zoom though, I feel it's quite trivial to see how it became popular. Of all the various video chat/conferencing software that exists, Zoom is the easiest for the layperson to setup and use while also tending to be the best performing in terms of audio/video quality, latency, large numbers of users on a single call, etc. My girlfriend was able join a Zoom call with her parents a few days ago without even telling them how to do it; yesterday I overheard a 30 minute phone conversation while she tried to explain to her mother how to edit a facebook post (unsuccessfully, despite valiant efforts).

Outside of this niche community, basically nobody knows or cares about Zoom's various security gaffes. They just want something that works and gets out of the way. And I say all this as somebody who has watched others use Zoom a few times and read about it, but never used it myself nor felt the inclination to.

I'm sure you're right about specialists and strategies to try to spark mass adoption being things that happen, but the technology matters as well.

adadahdjej• 6 years ago

I am truly disappointed. But I should have known better. Big woop. Keybase and Zoom deserve each other.

reneberlin9• 6 years ago

To all the utopist at the bar right now: do not give up!

reneberlin9• 6 years ago

Revoke all your keys. Give back any money you made of it. Relax. Enjoy your fucking life a little better as it should have been without keybase, bro.

reneberlin9• 6 years ago

Meh. They did it. Surprise. Think about what kind of intelligence is working in the inner of z00m. You should be afraid of them, the same as you are of whatsapp, telegram and your knik-knok to come.

dang4• 6 years ago

We changed the URL from https://blog.zoom.us/wordpress/2020/05/07/zoom-acquires-keyb... to the Keybase equivalent since more people were commenting on that one anyway.

gkoberger• 6 years ago

I don’t think they bought Keybase for the team or security. I think it’s one of the few good Slack competitors out there for sale.

Zoom definitely sees this as a chance to take on Slack given their new momentum.

reneberlin9• 6 years ago

I do not know the paperwork around this, but my guess is the same as with: WhatsApp-founders or some compareable. They begin hating what they did. Quit as fast as the contract allows.

And stupidly try to restart the same shit in the same niche.

blunte• 6 years ago

What the fuck? Now I have to look for another secure chat system.

reneberlin9• 6 years ago

keybase "joins" zoom get a better presser

reneberlin9• 6 years ago

HOW MUCH?

noodlesUK2• 6 years ago

This is so saddening. I use Keybase for a lot of my personal chat, as I find the signal multi-device workflow to be a bit crap. Keybase has been flawless. I love the kbfs and git integration, and I’ve desperately wanted to pay for ages. In fact the company I just started uses them for our git hosting and shared files. I’m gonna have to move now.

Please please please can someone fork and RE the backend code?

reneberlin9• 6 years ago

Lookinmg forward to see what happens to those boys standing up to make life easier for encryption and idintity. From that point of view, the project is canceled immediately.

noodlesUK2• 6 years ago

So, reading this, it’s clearly an aquihire, and they don’t care about the Keybase product. Please open source the server. We want our communities to still be able to run, and self hosting would be fine.

reneberlin9• 6 years ago

Saturation. The zoom folks had too much publicity.

reneberlin9• 6 years ago

Maybe they think, you understood the product so natively. You can reproduce it with a new domain: keybeasehasjustended.in?

oskenso• 6 years ago

Fork incoming~

AnonC• 6 years ago

This is sad. To me Keybase always seemed like it had a big mindshare among techies (more so before the cryptocurrency venture), but never had a good enough market share for its offerings (like chat, for example). As others here have said, Keybase could’ve launched some paid services.

With the shitshow that Zoom has turned out to be (there’s a long article on tidbits.com about the various issues), I don’t have any confidence that any part of Keybase as it exists now will survive. My belief is that it’ll shut down its services sometime this year or the next. I used it very rarely to verify certain identities, but am going to just delete my account and be done now.

clortho• 6 years ago

Optically, this is suspect. But, I don't blame Keybase. This is an opportunity for them. I hope Zoom doesn't mess it up.

rasengan0• 6 years ago

The shareholders will be pleased, enterprise and beyond: https://www.marketscreener.com/ZOOM-VIDEO-COMMUNICATIONS-570...

m0zg• 6 years ago

"All your base are belong to us", Zoom CEO was quoted as saying.

AndyKelley• 6 years ago

I worked at OkCupid long after Chris Coyne and Max Krohn abandoned it. From the vestigial remains of the founders' code and features it was clear what their main objectives were: have fun with cool tech, on the dime of VC funding. As soon as they got bored, they moved on to the next thing. KeyBase is the same pattern. I mean, good for them, they're successful by any measure - how they spend their time and how much money they have. But this outcome was to be expected.

frag• 6 years ago

I guess moving to Matrix?

monadic23• 6 years ago

This is really concerning given Zoom’s clear lack of security expertise—there’s no good outcome here.

sm4rk0• 6 years ago

I trusted Keybase. They sold me. I deleted my account. For the same reason I deleted my account when LinkedIn sold my data and trust to Microsoft.

fareesh• 6 years ago

Promising product but I will not use it anymore

nemoniac• 6 years ago

The Keybase client is open source. How hard would it be to build an open source server or federated servers to work with the client? Genuine question.

wjd2030• 6 years ago

account deleted. bye bye.

wharfjumper• 6 years ago

I would participate in (and could provide resources to) the creation of an open foundation that had as one of its goals the writing of an open source keybase API[0] compatible server.

If anyone else is interested, please contact me directly (email in my profile).

[0]https://keybase.io/docs/api/1.0

Legogris6• 6 years ago

Maybe try approaching the keys.pub devs?

dastx• 6 years ago

Had a quick look through it, seems a relatively easy implementation. I reckon if someone works full time on it, it'll take 6-12 months as it stands.

namibj5• 6 years ago

I'm not sure what profile you're referring to. But feel free to contact me on keybase, or via encrypted email. You can find a suitable key via keybase, even without creating an account/installing a client.

While there are likely limits to the extend of my potential involvement in these efforts, I'd not want that to be in the way of further communications.

dwighttk• 6 years ago

anybody want to buy some Lumens?

badrabbit• 6 years ago

I hate to be right but years ago people kept asking me to use keybase and I refused. Kinda defeated the whole "web of trust" mantra.

nske5• 6 years ago

Very unfortunate. Besides its main purpose, Keybase has been my chat app of choice for quite a while, after I decided I could no longer put up with Signal's general crappiness.

Keybase has been one of the very few performant and usable "new-style" applications that I've used -and the only one of its kind.

Sadly I am forced to suffer electron-based vomit every day -between Skype, Teams, Whatsapp, Hangouts, Facebook messenger and whatever else I might be fortunate enough to be forgetting. It sucks that I might have to be on the lookout for a decent encrypted chat application that I don't actually hate, again.

Not sure why the use-case of chat communications has been afflicted by so much crappiness -as if it's a curse.

LeoPanthera• 6 years ago

The Keybase app is also written in Electron.

nske5• 6 years ago

I know, that's why I was surprised it managed to somehow not suffer from the same performance and functionality problems that I observe on the rest I mentioned.

I didn't say that all electron apps have to suffer, at the same time it seems to me that there is a strong correlation.

anotherevan• 6 years ago

This reminds me of when Lastpass was bought by Logmein. It went downhill very fast after that. I hope history does not repeat itself.

the_resistence• 6 years ago

How will the need for private matters to stay private be dealt with as mainland China requires use of a version that provides surveillance of all calls?

austinjp2• 6 years ago

So, unless I've missed it in the comments here, what are the alternatives? Where are people putting their keys?

ece• 6 years ago

Mailvelope, KWallet, Signal, Jitsi, not sure what does encrypted IRC-like chats as well..

austinjp2• 6 years ago

Thread here: https://news.ycombinator.com/item?id=23103386

siruncledrew• 6 years ago

Somewhat predictable move. Buying a security company (on the cheap with Keybase) is an easy way to advertise “See, security now!”. It’s a fast-track solution to slap some duct tape on the problem and at least say they fixed it.

damanamathos4• 6 years ago

They bought Keybase to bring on a strong security team as they try to build end-to-end encryption into 1,000 person meetings which is currently not possible with any solution.[1]

They'll either deliver that or they won't.

[1] https://twitter.com/alexstamos/status/1258405729720918016

brigandish2• 6 years ago

There's a petition for them to open source the backend, much as that seems hopeless we should do something (and this is preferable to going back to gpg for everything:)

https://www.change.org/p/zoom-video-communications-inc-relea...

choppaface• 6 years ago

If you’re a Californian be sure to send your CCPA notice to privacy@keybase.io

CodeSheikh• 6 years ago

Is Zoom trying to disrupt Whatsapp space?

kirillzubovsky2• 6 years ago

Although I would consider myself to be a technical person in general sense, I was definitely a non-technical light user of Keybase. More specifically, I was not really concerned of how they did their encryption, as long as they did it well, and I had Keybase just in case I needed to encrypt, rather than than actually using it daily like some here.

Looking back on my usage of Keybase, I realize that encryption to me is a feature, not a tool or an app. I prefer my conversations encrypted, but I don't seek out an app that does it. I would like my files to not be tampered with, but I just kind of assume that's the default on Dropbox at el, even if it's not.

From this view point, it might be a good thing that Zoom acquired Keybase. I would have rather it be Slack or Google or Microsoft, but Zoom will have to do. If they don't murder the acquisition right away, there is a chance they turn Zoom and all their future tools into a more secure environment, in which case it's a win-win for all.

benecollyridam• 6 years ago

I thought this was satire

kerouanton• 6 years ago

Glad I deleted my keybase account several weeks ago...

mcovey• 6 years ago

I love(d) the idea of Keybase but I always had in the back of my mind that it was too good to be true. I'm guessing this will be the end as they announce in a few months that Keybase is being retired as it's "best security features" have been integrated into Zoom. Seems to happen to just about every good product that isn't fervently open-source.

quipquopro• 6 years ago

This unwise business transaction is forgivable, but the product placement for the woodworking neighbor is inexcusable.

peternicky• 6 years ago

very unfortunate news given that I have zero trust in zoom. To be honest, i've never found a unique use for keybase in the past years that my account was active and was always disappointed with the quality of their desktop and iphone applications.

later today or tomorrow when I have free time, I will be deleting my keybase account.

rbarroso• 6 years ago

Strangely the Core Security documents which should be available through the links on the Crypto page:

  - https://book.keybase.io/docs/crypto

are not available!

Missing linked documents:

  - https://book.keybase.io/docs/server_security
  - https://book.keybase.io/docs/server_security/merkle_root_in_bitcoin_blockchain
  - https://book.keybase.io/docs/sigchain

notpushkin5• 6 years ago

merkle_root_in_bitcoin_blockchain is now in the Server section: https://book.keybase.io/docs/server/merkle-root-in-bitcoin-b...

chrisma02• 6 years ago

This is the company with the "we recognize that there is a discrepancy between the commonly accepted definition of end-to-end encryption and how we were using it" statement... https://blog.zoom.us/wordpress/2020/04/01/facts-around-zoom-...

franga2000• 6 years ago

This might be an exaggeration, but this feels one of the last nails in the coffin of PGP. Keybase felt like it could become the thing that finally starts making PGP more widel-used by giving it some new powers (verifying social network identities, etc.) and from the way this acquisition looks, it won't last much longer or at least won't improve much.

It's a shame, really. The web of trust idea from PGP could've been really cool and useful to apply to modern social networking and communication services - one that I can imagine even some normal users using. But it seems that Keybase were one of the last willing to try...

Zoom Acquires Keybase

Related Stories