Official Keybase extension for Chrome(keybase.io)
keybase.io
Official Keybase extension for Chrome
https://keybase.io/docs/extension
33 コメント
I built my own chrome extension using keybase over a year ago, which I called AnyCrypt:
http://lettergram.github.io/AnyCrypt/
I use it with a few friends, it isn't super secure (in the sense I store people's private key locally). The real issue I had was two fold:
1. You guys really didn't want me pulling the private key from your servers. Although it was possible, I had to decode all the work you guys did, which sucked.
2. It wasn't seemless, i.e. I had to do some right clicking.
The one benefit I see on my current method, is I can use any chat to communicate. I already use signal, have encrypted emails, etc. So what do I gain using this extension?
http://lettergram.github.io/AnyCrypt/
I use it with a few friends, it isn't super secure (in the sense I store people's private key locally). The real issue I had was two fold:
1. You guys really didn't want me pulling the private key from your servers. Although it was possible, I had to decode all the work you guys did, which sucked.
2. It wasn't seemless, i.e. I had to do some right clicking.
The one benefit I see on my current method, is I can use any chat to communicate. I already use signal, have encrypted emails, etc. So what do I gain using this extension?
Hey, AnyCrypt looks cool!
Sorry to hear about your troubles reversing the key infrastructure. I'm not involved in that part of Keybase, but if you'd like to discuss it further I can put you in touch with the right people if you PM me.
Regarding what you're gaining with the extension: Our goal with the extension is to improve workflows for Keybase power users, and generally make it a little more user friendly/convenient in some scenarios.
As to what you gain from using Keybase: It's a much more sophisticated product than Signal or encrypted emails. A core proposition is cross-verified social proofs. You can Keybase chat with shazow@twitter and have a strong guarantee that it's also shazow@hackernews. The way Keybase does key management and device provisioning is very cool too. And did I mention file storage and sharing? And more coming soon!
Sorry to hear about your troubles reversing the key infrastructure. I'm not involved in that part of Keybase, but if you'd like to discuss it further I can put you in touch with the right people if you PM me.
Regarding what you're gaining with the extension: Our goal with the extension is to improve workflows for Keybase power users, and generally make it a little more user friendly/convenient in some scenarios.
As to what you gain from using Keybase: It's a much more sophisticated product than Signal or encrypted emails. A core proposition is cross-verified social proofs. You can Keybase chat with shazow@twitter and have a strong guarantee that it's also shazow@hackernews. The way Keybase does key management and device provisioning is very cool too. And did I mention file storage and sharing? And more coming soon!
Hey! I've been following the Keybase for some time and I really like the idea behind this project.
I installed the extension in my browser and now whenever I hit the "keybase chat" button I get the message "You need the Keybase app to send chat messages." The keybase desktop app obviously runs fine in the background.
Browser: Version 58.0.3029.110 Built on Ubuntu, running on Ubuntu 17.04 (64-bit)
Btw: Would you consider putting the Android app on F-Droid?
I installed the extension in my browser and now whenever I hit the "keybase chat" button I get the message "You need the Keybase app to send chat messages." The keybase desktop app obviously runs fine in the background.
Browser: Version 58.0.3029.110 Built on Ubuntu, running on Ubuntu 17.04 (64-bit)
Btw: Would you consider putting the Android app on F-Droid?
Could you confirm which version of Keybase you're running? `keybase version`
Also, is it Chrome or Chromium?
Feel free to message me directly on Keybase if you'd prefer: https://keybase.io/shazow
[Edit: In case anyone is curious, this has been resolved by restarting Chromium.]
Also, is it Chrome or Chromium?
Feel free to message me directly on Keybase if you'd prefer: https://keybase.io/shazow
[Edit: In case anyone is curious, this has been resolved by restarting Chromium.]
Would it be possible to upload an extension for Opera? I believe the platform is essentially identical.
The ultimate goal is to support any browser that implements the standard WebExtension API. Right now we're doing rapid prototyping so we're sticking to just Chrome for the time being, but more browsers will come as soon as we figure out what we want to stick with. :)
Stopped using Keybase after installing the windows graphical interface and it became increasingly intrusive to my daily workflow. I only login to keybase to obtain secrets from co-workers. If you don't login to keybase, quitting the interface on windows is extremely annoying and embedded deep in a custom right click interface.
Then, once it has been quit, after some time it will randomly start again asking you to sign in jarring you from whatever your current focus is on.
I've uninstalled it completely and moved on, very sad because I had high hopes.
Then, once it has been quit, after some time it will randomly start again asking you to sign in jarring you from whatever your current focus is on.
I've uninstalled it completely and moved on, very sad because I had high hopes.
Agreed. I misplaced my key for a bit, and it would prompt me for my password randomly after I clicked 'cancel'. Like, half hour later, prompt again. Adding on to that, you can't right click the taskbar icon to quit, you have to open it up, and go through a bespoke menu to exit.
That on top of the general sluggishness and bugs (kept telling me that HN could not be verified even though it had, and was according to the website.
It just feels so sloppy :/
That on top of the general sluggishness and bugs (kept telling me that HN could not be verified even though it had, and was according to the website.
It just feels so sloppy :/
I think this had only happened once to me, but I rarely sign out or close Keybase so I wouldn't be one to experience it frequently.
Are you sure you are quitting the program and not closing the program? Many programs nowadays continue to run in the background after clicking close but do not actually quit the program, seemingly confusing the close button with the minimize button. I think Keybase does this but I'm not home to test.
Most of the programs I'm aware of that do this terrible behavior are chat programs (Discord, Slack, maybe Keybase, maybe Teamspeak, Skype, etc.) and on most of these it can be disabled in the settings somewhere to actually quit the program when you close it.
Are you sure you are quitting the program and not closing the program? Many programs nowadays continue to run in the background after clicking close but do not actually quit the program, seemingly confusing the close button with the minimize button. I think Keybase does this but I'm not home to test.
Most of the programs I'm aware of that do this terrible behavior are chat programs (Discord, Slack, maybe Keybase, maybe Teamspeak, Skype, etc.) and on most of these it can be disabled in the settings somewhere to actually quit the program when you close it.
Yes, quitting the application completely, closing it just minimizes to the taskbar context menu, from there you can right click, the custom interface shows, click the hamburger menu, click quit. I completely quit every time for it to randomly start afterwards.
I'm a big fan of Keybase overall, but I share the annoyance of intrusive notifications. I don't really need to see a popup window of all users that pertain to my keybasefs folder every time I access it. Also, I've noticed keybasefs can be quite slow sometimes.
But these are minor annoyances in the context of a great product.
But these are minor annoyances in the context of a great product.
Thanks for the feedback! We've recently implemented some pretty big performance improvements in the filesystem, including prefetching files, caching them encrypted to your local disk, and journaling for writes (allowing us to sync them over some period rather than blocking on your network connection). If you're still experiencing poor performance in the filesystem, please file a ticket on github.com/keybase/kbfs or contact me on Keybase chat (keybase.io/jzila).
Just sent you some feedback using the extension :)
I've been trying out this extension for a few days.
What I would really like to see from this extension is a 1-click way to sign any message I'm writing, anywhere on the internet. Along with that would be the ability to verify that a keybase signature found in the wild belongs to a particular keybase user. Then I can initiate out-of-band discussions with the author of a comment on someone's blog, not just with a Reddit or Hacker News poster.
Having the keybase chat button appear next to posts on sites like Reddit, HN, etc. seems like a great step toward a "metaweb" platform as well. For example, I could let someone know about the typo in their post via keybase chat, rather than polluting the public comment stream.
Very excited.
What I would really like to see from this extension is a 1-click way to sign any message I'm writing, anywhere on the internet. Along with that would be the ability to verify that a keybase signature found in the wild belongs to a particular keybase user. Then I can initiate out-of-band discussions with the author of a comment on someone's blog, not just with a Reddit or Hacker News poster.
Having the keybase chat button appear next to posts on sites like Reddit, HN, etc. seems like a great step toward a "metaweb" platform as well. For example, I could let someone know about the typo in their post via keybase chat, rather than polluting the public comment stream.
Very excited.
I second this. Rough sketch: detect a text input I'm tying in, add a little button that says "sign and send", which when clicked adds a signature to the message and submits. If the extension sees this on a forum, verify the sig in the background and inject a little check mark next to the username if it checks out.
I like the idea of (semi?)automagically decrypting/verifying content on the web. It's on the list of ideas to explore, but not sure how soon. :)
If you have more specific use cases in mind, I'd love to hear them.
If you have more specific use cases in mind, I'd love to hear them.
I would like the same functionality and I would love if it supported encryption as well as signing.
General Keybase question:
How is it possible to (1) send a message to someone before they've signed up and (2) prevent Keybase from being able to decrypt the message? This is a surprising capability. Didn't realize it was possible. I'm curious how.
How is it possible to (1) send a message to someone before they've signed up and (2) prevent Keybase from being able to decrypt the message? This is a surprising capability. Didn't realize it was possible. I'm curious how.
From the beginning of Keybase, we considered this specific user flow very important.
(1) if there's no one on keybase who matches your "assertion", say a certain twitter account or HN account or whatever,
(2) the keybase app encrypts it just for yourself, but signs a message (for yourself) declaring the assertion
(3) when someone proves that assertion publicly, by joining keybase and connecting an account, they are announcing and proving ownership of key(s), and proving publicly they have control of that account and keys
(4) the keybase server wakes up your app and tells it to verify your assertion is now satisfied, and
(5) your app checks the announcement by actually visiting Twitter and then, if the crypto is good, rekeys the data - there's nothing for you to do other than to have the app running, since the human steps were already done back when you made the assertion by writing the message.
Depending on how loosely you use the term, this is a type of TOFU (trust on first use): you're trusting that the assertion provider, say, Twitter, doesn't steal an account out from underneath one of its users, or the user doesn't lose control of her/his account. Note that this would be publicly discoverable because all announcements are written publicly to Keybase's merkle tree.
This is just about the best imaginable key establishment we can think of without meeting in person. It's certainly better better than, say, trusting a key service to map a phone number to a public key. And it's safer than posting PGP fingerprints or public keys on Twitter - in that case there's no way to tell if everyone else is getting the same answer as you.
edit: formatting
(1) if there's no one on keybase who matches your "assertion", say a certain twitter account or HN account or whatever,
(2) the keybase app encrypts it just for yourself, but signs a message (for yourself) declaring the assertion
(3) when someone proves that assertion publicly, by joining keybase and connecting an account, they are announcing and proving ownership of key(s), and proving publicly they have control of that account and keys
(4) the keybase server wakes up your app and tells it to verify your assertion is now satisfied, and
(5) your app checks the announcement by actually visiting Twitter and then, if the crypto is good, rekeys the data - there's nothing for you to do other than to have the app running, since the human steps were already done back when you made the assertion by writing the message.
Depending on how loosely you use the term, this is a type of TOFU (trust on first use): you're trusting that the assertion provider, say, Twitter, doesn't steal an account out from underneath one of its users, or the user doesn't lose control of her/his account. Note that this would be publicly discoverable because all announcements are written publicly to Keybase's merkle tree.
This is just about the best imaginable key establishment we can think of without meeting in person. It's certainly better better than, say, trusting a key service to map a phone number to a public key. And it's safer than posting PGP fingerprints or public keys on Twitter - in that case there's no way to tell if everyone else is getting the same answer as you.
edit: formatting
Great question!
We give a little bit of detail here: https://keybase.io/docs/kbfs#frictionless-sharing
But the basic model is that when you share or chat with someone@twitter, that content is only encrypted to your devices. When that Twitter account posts a proof, and announces that proof on a Keybase account, Keybase's servers will notify your devices including a link to the tweet. Your device will independently verify that the cryptographic proof is validated by the keys of the Keybase account claiming it, after which it'll re-encrypt the keys to that data for the newly verified Keybase account.
This all happens seamlessly in the background.
We give a little bit of detail here: https://keybase.io/docs/kbfs#frictionless-sharing
But the basic model is that when you share or chat with someone@twitter, that content is only encrypted to your devices. When that Twitter account posts a proof, and announces that proof on a Keybase account, Keybase's servers will notify your devices including a link to the tweet. Your device will independently verify that the cryptographic proof is validated by the keys of the Keybase account claiming it, after which it'll re-encrypt the keys to that data for the newly verified Keybase account.
This all happens seamlessly in the background.
You send a message to [the person who can prove ownership of HN username 'perfmode'].
c.f.: https://keybase.io/docs/kbfs
c.f.: https://keybase.io/docs/kbfs
Soon, you'll be able to throw data into /keybase/private/yourname,pal@twitter,
even if that Twitter user hasn't joined Keybase yet.
Your app will encrypt just for you and then awake and
rekey in the background when that Twitter user joins
and announces a key.I may be completely wrong, but my recollection is it requires you to be running the Keybase software, which gets notified when the user signs up so it can rekey the payload for them.
Any thoughts on Keybase's part on getting into the password management space? Seems like the infrastructure is all there.
Before we settled on building a browser extension, my first proposal was actually to build a password manager on top of Keybase. It's a very exciting idea, but also the scope is pretty huge.
Right now the team is focused to get the Keybase platform to a place where even third-party developers could build things like password managers on top of it while getting the benefit of all of the things that make Keybase special.
Right now the team is focused to get the Keybase platform to a place where even third-party developers could build things like password managers on top of it while getting the benefit of all of the things that make Keybase special.
Personally I think more interesting would be integrating keybase based gpg functionality to the sites themselves, like for example GPG encrypted DMs on Twitter, or signed messages for Reddit.
Gave it a try. I like deeper integration with social services, but I'm not too excited that it's primarily just a shortcut to the app's chat feature (which I don't really use, honestly).
I was hoping that it would let me send signed/encrypted tweets, or Gmail messages right on the page. Is that within the scope of the project, or is everything meant to happen from within the app?
I was hoping that it would let me send signed/encrypted tweets, or Gmail messages right on the page. Is that within the scope of the project, or is everything meant to happen from within the app?
Publishing encrypted tweets wouldn't work too well with the character limit and all, unless I suppose we use images and OCR[0].
For things like encrypting emails inline, we could explore it but I'm not convinced it's a good use case: To get all the benefits of Keybase (identity verification, key/device provisioning, improved encryption over PGP), the recipients would also need to have Keybase installed which means you could just use Keybase Chat instead.
[0] https://twitter.com/shazow/status/605748307688890368, https://github.com/Lukasa/entweet
For things like encrypting emails inline, we could explore it but I'm not convinced it's a good use case: To get all the benefits of Keybase (identity verification, key/device provisioning, improved encryption over PGP), the recipients would also need to have Keybase installed which means you could just use Keybase Chat instead.
[0] https://twitter.com/shazow/status/605748307688890368, https://github.com/Lukasa/entweet
Fair point on tweet length. I hadn't considered that. Do Direct Messages have a character limit? I'm unsure.
For Gmail I think it could still make sense for those who have a Keybase account/key, but haven't yet downloaded the app (this was me for a while).
Just as an example, I have a work contact who I am often exchanging passwords with. We use Proton Mail for these, and Gmail for everything else. Saying "I sent you X on proton" is a lot more cumbersome than "here's an encrypted message", and being able to decode it inline.
We could use Keybase's webapp, but it still requires going to an external site to encrypt/decrypt messages. So it's not a big enough draw to change our workflow yet.
I understand the argument that Keybase Chat has more built in benefits, but sometimes you just prefer email to live chat. It's also an easier sell to download a Chrome extension once, than download an app and run it 24/7.
Admittedly that's just my use-case. I like to think of Keybase as easily accessible PGP functionality, so that's where I'm most interested in seeing it grow.
I know Google's working on the problem I described with their end-to-end extension[1], but it's been years in development so who's to say when it'll be ready.
Regardless, I think the product is great. Looking forward to seeing what you guys put out in the future.
[1] https://github.com/google/end-to-end
For Gmail I think it could still make sense for those who have a Keybase account/key, but haven't yet downloaded the app (this was me for a while).
Just as an example, I have a work contact who I am often exchanging passwords with. We use Proton Mail for these, and Gmail for everything else. Saying "I sent you X on proton" is a lot more cumbersome than "here's an encrypted message", and being able to decode it inline.
We could use Keybase's webapp, but it still requires going to an external site to encrypt/decrypt messages. So it's not a big enough draw to change our workflow yet.
I understand the argument that Keybase Chat has more built in benefits, but sometimes you just prefer email to live chat. It's also an easier sell to download a Chrome extension once, than download an app and run it 24/7.
Admittedly that's just my use-case. I like to think of Keybase as easily accessible PGP functionality, so that's where I'm most interested in seeing it grow.
I know Google's working on the problem I described with their end-to-end extension[1], but it's been years in development so who's to say when it'll be ready.
Regardless, I think the product is great. Looking forward to seeing what you guys put out in the future.
[1] https://github.com/google/end-to-end
Hi SquareWheel.
I use Keybase as a "Here's my Public Key and I am who I say I am".
For e-mail/Gmail I use Mailvelope it's fairly easy to setup and use. I recommend you take a look at that in regards to e-mail encryption if you don't already have a system.
You can see more here:
https://www.mailvelope.com/en
And here is a presentation of mailvelope from the excellent Hak5 team.
https://www.youtube.com/watch?v=hDCjhKcA0IE
I love it! A minor question: is there any way to have profiles, so to speak, so that I can switch between official and 'casual' online identities?
We've been experimenting with a bunch of different ideas and features—most of them you can enable/disable in the extension's "options". We launched a Reddit-focused extension last month but this release embraces all of the social networks that we support.
I'll be writing up a blog post soon, particularly about how we use the WebExtension NativeMessaging API to communicate securely with the Keybase service.