[messaging] MITM-safe communication w/o authentication possible?

[Max Krohn]

Keybase is still working hard on this problem.  We’ve gotten a ton of useful feedback from people in this community and others, and are just soft-launching the next version of our client.  The two big new features are: per-device secret keys that never leave the devices they are created on [1]; and a full rewrite in Go.  We’re still building a hosted cloud filesystem to take advantage of Keybase as a key exchange system, which isn’t quite ready for alpha-testing, but is getting much closer.  In the shorter term, we’re close to rolling out a PGP-like message format (useful in e-mails or Web-based text fields) to take advantage of this new per-device key model. We took the opportunity to make something that’s modern and simple, just a small wrapper around NaCl and doesn’t require an implementation of every ciphersuite under the sun. We’re working on a spec that we hope to circulate before it sees any use.

All of our software is open source and in testing we’ve run it successfully on all major platforms including iOS, Android and Windows [2]; people are welcome to hack on any additions they want. Internally we haven’t fully worked out the details of how third party applications should work, since we’re still debating how mutually distrustful apps should be. Just maintain the desktop status quo — it’s on you if you install an evil app? Or try some sandboxing scheme that will certainly be less portable and useful?

[1] Here’s an example of what accounts now look like: https://keybase.io/chris/graph
[2] https://github.com/keybase/client
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://moderncrypto.org/mail-archive/messaging/attachments/20151129/6bf6ae70/attachment.sig>