Yeah, with the recent issues they had after doing the cryptocurrency stuff (which didn&#x27;t really bother me, but it definitely seemed to generate some negative feelings in general), this feels like a poorly-timed move.Zoom is presumably going for &quot;look, we are bringing on-board this team of trusted people who understand privacy&quot;, but I think most are just going to assume it&#x27;ll work the other way and Zoom&#x27;s culture of poor security practice will bleed into Keybase over time.

I don&#x27;t quite know how to feel about this. Perhaps it is my mistrust against Zoom, but I did enjoy the run Keybase had as a semi-independent key and ID manager.

&gt; This project is in development and has not been audited.

keys.pub:<a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22995792" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=22995792</a><a href="https:&#x2F;&#x2F;keys.pub&#x2F;" rel="nofollow">https:&#x2F;&#x2F;keys.pub&#x2F;</a>

And I’m done with Keybase.What’s that open source alternative that someone recently posted here?

Whoa, how much? The press release doesn’t say, but this will come out eventually since Zoom is publicly traded, right?

Congrats to the keybase team! They seemed to grow in fits and starts, hopefully this sort of thing helps push encryption to even more places.

Never thought of Keybase as a team chat product. Maybe thats just because I&#x27;m one of the older users :)

Why? Keybase&#x27;s product is team chat. Zoom wants to kill Slack. Seems perfect.(Keybase&#x27;s crypto stuff is nifty, but we all know there is no money in that. They tried to make money by integrating cryptocurrency, and people did NOT seem to like that. So here we are.)

Congratulations, malgorithms and team!Selfishly hoping the cores service isn&#x27;t shut down, though. I&#x27;ve been using it authoritatively for 5+ years. Treasuring the username I got too.

&gt; Zoom seeks to become the single &quot;remote work tool&quot;, challenging Dropbox, et al. directly.Maybe they should work on the fact I can run Zoom in screen share and just about nothing else. Just entering a call for me takes ~75% of my CPU and I beach ball regularly when screen sharing lightweight text editors doing barely more than scrolling and typing.

This is precisely why Zoom is acquiring Keybase. Zoom seeks to become the single &quot;remote work tool&quot;, challenging Dropbox, et al. directly.I&#x27;m particularly disenchanted with the growth of these multipurpose tools, but I am not their target audience. (Nor, I suspect, are many HN participants, but this is a baseless guess.) I suppose I&#x27;m more of an adherent to so-called &quot;UNIX philosophy&quot;--the best, single-purpose tool for each task, preferably that can be combined with its like for a solution customizable to how a specific user gets work done.

Yes. I recently started exploring keybase. I extensively use their filesystem and private git repo. Sad to see them go.

I had such high hopes for Keybase; kbfs had completely replaced Dropbox for me. This is terrible news.

Many weird acquisitions past few years but all make sense from a monopolistic angle.Startpage by an ad company.PIA by an anti privacy malware company.Keybase being a slack competitor merging with zoom makes much more sense in retrospect. Zoom is insecure while keybase is seen as secure.Companies are purchasing competitors or revenue stealers.

Guess I shouldn’t be surprised. After all, Microsoft acquired GitHub, IBM acquired RedHat.

I&#x27;m curious where Keybase refugees are going to end up. Matrix? Telegram?

Likewise. My friends and I have been using it throughout the pandemic to chat, I&#x27;ve been using it for years, but we&#x27;re all deleting our accounts this morning. All around unsettling news as far as keybase software goes. Congratulations keybase team, though.

Congrats to the keybase team, but I guess I&#x27;ll just stop using it

Zoom: Well boys, we did it. Privacy problems are no more.

I use it for shared network storage, frictionless private git repoisitories, basic static web hosting, personal and work chat, and I make heavy use of the teams feature. Not a day goes by I don&#x27;t use it for something.

Thank you!I&#x27;ve been using it on and off for years.. I&#x27;m still not sure what exactly it is or under what circumstances I should be using it.

Oof. Keybase was struggling to define what exactly it was, so I guess they is the best exit option for them anyway...

It was well-intentioned. For a time, Keybase provided users the option to upload their private keys so they didn&#x27;t have to maintain them themselves. You could just log into Keybase and send signed messages, decrypt messages, etc without the hassle of managing your keys locally. It was definitely a bad idea and I think they dropped it a few months&#x2F;years later, but it at least wasn&#x27;t totally out of left field.

No, they didn&#x27;t. There is an option to have Keybase sync a [backup] copy of your private key(s) between your devices for you but the key is encrypted by you. And, none of their stuff like chat or git etc. depends on using&#x2F;accessing those keys in anyway (they built out their own domain-applicable pki for that—in other words, chat doesn&#x27;t use pgp). It’s just a convenience option for those who want it and it’s not the default.

Wait, what? People gave Keybase their private keys?? Isn&#x27;t keybase just some glorified modernized web of trust infrastructure?

It&#x27;s deeper than &quot;Chat Security&quot;. There is current litigation against Zoom marketing of the misuse of &#x27;end to end&#x27; encryption. This is the best way forward of claiming ineptitude and their path to rectify.

Or, maybe Keybase needs video, and Zoom needs chat and security, in order to compete with the new wave of “productivity” suites. Why would Keybase suddenly be a failure or get worse in the security department because they are owned by a successful video conferencing company?

That&#x27;s not a flaw, that&#x27;s the main feature I was using it for.

Or you can just use keybase to only add your accounts that already have the same username and leave the others disconnected.

honestly the real security fail in keybase seemed to be users flocking to add every single social media identity to their keybase account, allowing anyone using the public API to remove all doubt that greg1234 on twitter == karl5912 on reddit == john1005 on HN, etc.scrape all those social media posts, reddit subs, etc. and you&#x27;ve probably got a solid idea of who that user is. all under the guise of public FLOSS stuff.

Looks like it wasn&#x27;t a good idea to leave your private keys in Keybase&#x27;s servers was it?Perhaps the moment that Keybase took VC funding a while back, it was over to begin with and the principles of being a &quot;Slack competitor&quot; and respecting their users privacy went straight out of the window and into the bin.I really had high hopes for Keybase as a Slack competitor, the cryptocurrency stuff I actively ignored, but this is a disaster.Fission Mailed.

&quot;We are excited to integrate Keybase’s team into the Zoom family to help us build end-to-end encryption that can reach current Zoom scalability.&quot;you mean... to help you sort out your false advertising.I just pulled a random page from Dec 25 of 2019 from internet archive where the site says this:<a href="https:&#x2F;&#x2F;d.pr&#x2F;i&#x2F;w3Ac0f" rel="nofollow">https:&#x2F;&#x2F;d.pr&#x2F;i&#x2F;w3Ac0f</a>Meet securely
End-to-end encryption for all meetings, role-based user security, password protection, waiting rooms, and place attendee on hold.<a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191225055029&#x2F;https:&#x2F;&#x2F;zoom.us&#x2F;meetings" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191225055029&#x2F;https:&#x2F;&#x2F;zoom.us&#x2F;m...</a>Fake it til you make it?

Let alone the legalese included that makes &#x27;will not&#x27; lose any meaning at all.

only that it is not.warrant canaries must be written in the past tense. This is future tense. So they can monitor millions of calls, and give your information away at every second. This text only tells you about the next second (a promise they will break too, but then the text will be about the next second)

I thought warrant canaries had to be in financial reports because those are one of the documents where companies are legally cannot lie under SEC rules?

Consider these promises a warrant canary. They will be removed at some point.

“...will not proactively monitor...”“...will not build a mechanism to decrypt live meetings...”So, this means that they can record meetings, then retroactively decrypt and monitor meeting contents :)

What makes you think that CALEA applies to Zoom (in the U.S.)?IANAL, but I&#x27;m reasonably confident that it does not.

The statement about lawful intercept can only be considered a blatant lie. It’s a requirement in China and CALEA applies in the US. Europe, India and Australia have their own laws around this.

&gt;What do you expect them to do? Hire a PMC and fight a war with the police when they come around to raid the server room? Go into hiding so that the security agency can&#x27;t steal the upgrade signing key from them?No, we want them to assume the same thing we are assuming. That if their service becomes successful, they will be coerced to compromise their users, regardless of how frequently they promise that they would never do so.If they are even bothering to make public announcements like this, then that means they believe the security of their system can be founded on the honor of their employees. It&#x27;s important to recognize that this isn&#x27;t even true if you assume every member of their team is an uncorruptible seraphim.Instead, where possible, the service should be zero knowledge, where not possible, it should be considered insecure.

&gt; We can&#x27;t expect all of the internet to operate like Wikileaks and The Pirate Bay.Why not? That&#x27;s just what it takes.&gt; If the justice system is broken, then the people aren&#x27;t safe.It is, and they are. After 50 years under the heel of the war on drugs, how is it not 100% obvious?

Building reasonable end-to-end encryption in the first place isn&#x27;t rocket science. In fact, Keybase have done just that. As well as WhatsApp, Signal, and many others.

Well, yeah, duh.What do you expect them to do? Hire a PMC and fight a war with the police when they come around to raid the server room? Go into hiding so that the security agency can&#x27;t steal the upgrade signing key from them?We can&#x27;t expect all of the internet to operate like Wikileaks and The Pirate Bay. If the justice system is broken, then the people aren&#x27;t safe.

It also does not say that they have not provided key material or RNG output, or that they have not deliberately weakened any aspect of their design other than &quot;cryptographic backdoors&quot; to accommodate law enforcement desires.These kinds of statements are typically most usefully interpreted as a template for the kinds of things they plan to do, just maybe not exactly in that way.

&gt; Zoom does not and will not proactively monitor meeting contents, but our trust and safety team will continue to use automated tools to look for evidence of abusive users based upon other available data.&gt; Zoom has not and will not build a mechanism to decrypt live meetings for lawful intercept purposes.&gt; We also do not have a means to insert our employees or others into meetings without being reflected in the participant list. We will not build any cryptographic backdoors to allow for the secret monitoring of meetings.One court + gag order and all of these promises are out the window.

While honourable advice, the bottom line is Keybase sold without having a business model.So perhaps better advice is, start a business even if you don’t have a plan and someone may buy it anyway.

Sometimes, acquihire is the business model. It makes money for the VCs and money for the founders. It&#x27;s just the fools^wconsumers who bought in early (and the non-essential employees) who get the shaft.

What&#x27;s our business model, how are we making money? Umm... don&#x27;t ask me - I&#x27;m just the founder!The sad thing is that you need to remind people of it. I would never start a business without an idea of a viable business model for it. What do they expect? Growing until they are too large to fail and then ... Godot arrives and everything is fine?

Yeah holy crap. I&#x27;ve been a big fan of Keybase since they launched, but this is a deathknell. I guess I&#x27;m not too surprised, Keybase didn&#x27;t seem to have a business model, but still, disappointing that they&#x27;re going to go into death this way.Attention people starting businesses: VC funding is fun and all, but please, have a business model. Your users and employees depend on it.

I&#x27;ll take what you&#x27;re drinking ;-)

Then why acquire? Why not just hire as a consultant?

It seems that we live in an era where if you made bad decisions in the past, you can never be trusted to make good decisions ever again. Even if you own your bad decisions and show lots of improvement.Nope. Once a pariah, always a pariah.

In general, when it&#x27;s between fresh blood and old management, old management will win every time.If Zoom is acquiring Keybase because the C-suite is pivoting culture around security, then it&#x27;ll probably work. Otherwise, not much will change. So until I see more evidence that Zoom&#x27;s upper management had a change of heart (creating a CISO council is a good start), I&#x27;m going to be skeptical that this will actually move the needle.

I really hope that&#x27;s the case, for Zoom&#x27;s sake. Unfortunately, that means less than nothing to me; I don&#x27;t use Zoom, whilst I do use Keybase.I don&#x27;t trust Zoom to be custodians of the Keybase company or software. This has been a real blow to my confidence in them and I&#x27;m not sure I&#x27;ll continue to use Keybase :(

I actually love Zoom as a product - far and away the best product in its class and this move likely makes sense for Zoom.The disappointment comes from the loss of Keybase and what it could have been.The main problem is Zoom having most of its development done via companies based in China. This means it is no longer possible for Keybase to achieve its original goal (and whatever encryption they add cannot fix this core problem).It&#x27;s one thing to accept the risk for video conferencing, but it&#x27;s another to accept for an encryption ID standard.I agreed with Chris Coyne&#x27;s comments on HN a while back when he argued that the closed source server code didn&#x27;t matter because of how they handled the encryption (when compared to Signal). While that&#x27;s still true from a technical security standpoint, it looks like it does matter in a larger sense because this kind of sale shows that you can&#x27;t really trust a company to act in its user&#x27;s interests long-term.

I agree. I&#x27;d bet all the cash in my wallet that this was Zoom doing a talent acquisition, to bring a team of crypto experts on board.

Has an acquisition ever worked like that in practice? I’ve heard that github might qualify but... Keybase ain’t no github.

&gt; why not look at the problem the other way around?Because no one ever buys or hires a conscience. If you thought a conscience was worth having one, that implies you would already have one and thus wouldn&#x27;t need to outsource it in the first place.Ethics always rolls downhill. If Al Capone goes out and hires Mr. Rogers, the power imbalance between them means Mr. Rogers is going to get dirtier than Capone will get clean.

why not look at the problem the other way around?I don&#x27;t have much respect for zoom&#x27;s security practices, while I do have much respect for the keybase team.Perhaps this is Zoom&#x27;s way of admitting that there is no way they can just solve the problem internally by keeping doing what they&#x27;re doing and they need to get some fresh blood and build upon good practices designed outside their current culture.

Might not be significant part of keybase and bots don&#x27;t need privacy. ;)

Yeah for the few people in the world who actually used Keybase and understood (at least partially) why it was a neat thing... most of those people are also those who have been following the Zoom debacle, and will likely consider abandoning the platform.

Even as an information security practitioner that cares a great deal about privacy I am just not willing to jump on this &quot;Zoom is bad&quot; band wagon. &quot;Zoom is bad&quot; is a tech media narrative largely driven by the large players that have something to gain by seeing Zoom stumble. There may be QC concerns, but in general the product has been great for our team and our consensus was to give them some time. Their response has been positive and they seem to have handled it transparently. Reality says this: Zoom works well enough. When we started using it several years ago it was far ahead of the competitors. Maybe they are catching up? Anyhow, I will give Zoom a chance to do the right thing over the next 6-12 months regarding Keybase, and their product in general.

Given the security concerns around Zoom, and the apparent lack of QC that might have prevented those concerns, this news is appalling.  I love Keybase, it&#x27;s used by many people, but I suspect it will now die a quick death. More accurately I suspect it will slide into a coma - not quite dead, but not in wide use anymore either.

DAO:<a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Decentralized_autonomous_organization" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Decentralized_autonomous_organ...</a>

By definition, worker coops are never acquirable by private controlling interests; they are always employee-owned.

Ghost (blogging software) chose to incorporate as a Company Limited by Guarantee [1], which doesn&#x27;t have shares and can&#x27;t be acquired that way: <a href="https:&#x2F;&#x2F;ghost.org&#x2F;changelog&#x2F;moving-to-singapore&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ghost.org&#x2F;changelog&#x2F;moving-to-singapore&#x2F;</a>[1] <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Private_company_limited_by_guarantee" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;Private_company_limited_by_gua...</a>

We need a new type of company that can never be acquired.

For most, sure. How else do you &quot;exit&quot;? It&#x27;s not a great time for an IPO. Nor for raising money.So either you&#x27;re self-sustaining and are in it for the long haul, or you&#x27;re looking to get acquired.

Wait what? That&#x27;s called PGP. And people like to hate on it because it&#x27;s a decentralized web of trust. The whole point of Keybase is to pave over the problems with web of trust by creating a social identity layer that more accurately reflects how trust relationships actually form.An open source social identity attestation layer that people can operate and federate. Now that sounds cool!

I think it is inevitable, yeah. But, this wouldn&#x27;t have been a problem if the product itself was decentralized.For example, if it was optional to connect to the Keybase network to begin with.Imagine a keybase-type app that is built on web of trust rather than centralized servers.

Typical VC terms give them veto rights over future deals even though they are minority stakeholders.

No, that&#x27;s not how this works.This outcome is almost certainly seen as a failure by the VCs. It looks like an acquihire. If so, it&#x27;s quite possible that the VCs didn&#x27;t even get their money back. Acquihires generally do not return money to VCs -- obviously, given that the employees are free to work anywhere, the acquirer&#x27;s interest is in paying as much as possible to the employees and as little as possible to the now-worthless acquired company.It&#x27;s likely the employees are the ones benefiting most from this outcome, in that their pay has probably gone up considerably and they are no longer nervous about their job security, after many years of high stress and low pay.It&#x27;s possible the VCs were even offering some more cash to keep going, but at unfavorable terms, and the team said: &quot;No, we&#x27;d rather take the big paychecks from Zoom.&quot;Given Keybase has only had one funding round (according to crunchbase), the founders certainly still had a controlling stake in the company and the VCs couldn&#x27;t force them to sell or not sell.You can blame VCs for a lot of things but this kind of outcome is just not one of them (except insofar as that it allowed a company with little viable business strategy to exist in the first place).(I am the founder of a failed startup. We had multiple &quot;acquihire&quot; offers, none of which offered any money back to investors.)

My two cents: that&#x27;s part of the game in today&#x27;s marketplace. It&#x27;s pretty difficult to &#x27;disrupt&#x27; firmly cemented market footholds and play with the big boys with seemingly endless streams of capital (though it certainly is possible, tech is more notorious for this than most industries, though highly improbable).You really want to lock down some strategic IP that stands in the path of a behemoth and hope they&#x27;ll want to aquire it under their growth goals or attempts to stomp out potential competitors (by throwing money at them and not through litigation or other paths). The big boys win because they buy out proven effective solutions&#x2F;IP and models while failed startups eat the market high-risk exploratory costs.

The fact that the ultimate goal of most startups is to &quot;exit&quot; says an awful lot. It&#x27;s an obvious signal that they are not prioritizing your needs in the long-term.

I&#x27;m seeing a certain pattern here, aren&#x27;t we all just fooling ourselves?Isn&#x27;t this just all inevitable? Aren&#x27;t all these startups just lining up all in the hopes just to get acquired?I guess when we see VC Funded™ on any startup what it _really means_ is that:&quot;We are prioritising a return for our investors even if it means violating our mission statement&quot;.

Seems a rather poor cultural fit, to say the least.

First, a huge congratulations to the founders of Keybase! Running a self-founded messaging company can&#x27;t be an easy feat.For me personally, this is of course worrying news. I&#x27;ll suspect that Keybase will die a rather quick death, as most of it&#x27;s users are security minded that wouldn&#x27;t ever trust Zoom.

They’re not oblivious but two things; you don’t bite the hand that feeds and it’s easier to get someone to see your side of things when you agree with them.  Confrontation will not help to fix Zoom’s culture of insecurity.

Zoom is publicly traded. Assume their blog post had to be approved by Zoom&#x27;s press department.

They aren’t. They are making a lot of money which is what the business was made for.The post is actually refreshingly honest that keybase is now abandoned and will probably die at some point.The idea that companies were stupid enough to place their internal identity on some random 3rd party is so incredibly stupid that it’s hard to feel too bad for anyone.Congrats Keybase!

&gt;How can they be so obvlivious though? Their own blog post doesn&#x27;t even mention the tarnished reputation Zoom has acquired latelyI&#x27;d say, don&#x27;t overestimate the tarnished reputation (= some news stories for a while, most didn&#x27;t read or care about -- including corporate users).And of course they wouldn&#x27;t get into it in a press release&#x2F;blog post for an unrelated to the issue acquisition! Doesn&#x27;t make sense to sabotage themselves this way...

Sure, the reputation might be tarnished, but to it seems like they have hired recently to ensure people that they are taking measures to change that.This seems like an extension of that. If anyone has thought a lot about multi-party encrypted communication it is the keybase folks.

&gt; doesn&#x27;t even mention the tarnished reputation Zoom has acquired latelyI&#x27;m interested to know if you thought keybase doing the whole unsolicited Initial Coin Offering was a reputation tarnishing or polishing event for that company. (I&#x27;m circumspect about both of these outfits to be honest.)

That&#x27;s probably why Zoom is buying them, to double down on security and repair their reputation. They genuinely seem to be putting all their focus on improving security. Seems like a smart buy to me.

How can they be so obvlivious though? Their own blog post doesn&#x27;t even mention the tarnished reputation Zoom has acquired lately.A lot of people will stop developing integrations for Keybase because of this. It&#x27;s sad.

Well, it&#x27;s pretty clearly an aquihire. Zoom gets a team of highly skilled cryptographers and Internet protocol experts. Good for them. But that means the team that created Keybase as an innovate PKI store won&#x27;t be working on that anymore. That&#x27;s not Zoom&#x27;s business, and probably won&#x27;t be, as Keybase  themselves never figured out how to turn it into a business.

Zoom is actually one of the view applications that can screen share on WaylandI believe it&#x27;s only enabled for a few distros though

If Keybase acquired Zoom (haha), then, sure. This is a PR move for a public company. They&#x27;ll probably gut Keybase, move their Chinese server generated AES128 keys to AES256 keys generated by you and uploaded to their Chinese server, then call it a day.I can&#x27;t think of a single instance where acquisition of a smaller company like this resulted in an improved version of the original product. How many of us are running RHL? Skype is now close to Microsoft spyware that&#x27;s impossible to remove from a Windows installation. Facebook purchasing Whatsapp, another service that formerly stressed encryption, resulted in things like plaintext backups of your texts on Facebook servers being aggressively promoted as soon as you loaded the app.It&#x27;s pretty much always cheaper to gut the original product, ignore the problems with your software, and enjoy the enhanced price of your shares while effectively spending no more money than you had for the original acquisition. As far as I can tell, Keybase has never had a business model or constant source of revenue.

&gt; If keybase ultimately gets secure video, and zoom a security architecture overhaul, how is that a bad thing?If.

Is wayland support even a femto blip on Zoom&#x27;s radar ?

Who gives a fuck about Wayland, honestly? It seems like it was designed by people who didn&#x27;t like the few good things about X and wanted something to further fracture the Linux desktop. Well, they got it.&gt; Zoom needs people who know how to make modern client softwareIt&#x27;s the best video client available on Windows &#x2F; Mac and works acceptably on Linux, what exactly needs to be more &quot;modern&quot; about it? Slack&#x27;s video call thing is way less featureful, and Teams is still the abortion that is Lync &#x2F; Skype for Business under the hood which is and always will be shit-tier.&gt; chatI don&#x27;t want my video app to be my chat app. There&#x27;s any number of reasons why separation there is a good thing. I can start a Zoom call from Slack in 1 second, what more do I really need on that front?

I don’t necessarily read it that way. Keybase is 100% functional and has worked well for a long time. Zoom needs people who know how to make modern client software and chat if they want to compete with the Slacks and Teams, etc. You can’t even screen share on wayland... it’s that bad. If keybase ultimately gets secure video, and zoom a security architecture overhaul, how is that a bad thing?

Bonkers how? Zoom gave them money, they took the money.

Isn&#x27;t getting bought and there being no plans for your business bonkers? Or at least, it&#x27;s a bonkers&#x2F;highly-unusual admission that it&#x27;s an acqui-hire.

It doesn’t have to be mainstream. A niche product can be viable.Unless you begin to accept investors money who want an exponential growth at all cost. But if that’s what you want as an investor, no idea why you would invest in Keybase.

I remember thinking they were neat a few years ago, I made an account and tried out exchanging some keys. It’s slick but I don’t see how it was ever going to be a mainstream product for non technical users who mostly don’t even understand what encryption is. Haven’t heard anything about them since, I kinda already assumed they were dead.

Lucky for us it is open source? I was hoping to use it to replace Dropbox but they kept not taking my money... small wonder they went for the acquisition.

While it&#x27;s a cool tool, what exactly was the (commercial) potential Keybase had? I could never tell.

&gt; So, yup, keybase is dead.Well, shit.Keybase had an amazing potential. I use it every day to ad-hoc securely share&#x2F;store stuff. It will be sad to see it wither even more than it has. :(

Keybase product and engineering do not think this way.  Corporate PR thinks this way. Don&#x27;t get it twisted.

Come on, the engineers at Keybase are serious crypto nuts. Give them some more credit

,,helping to make Zoom even more secure. &#x27;&#x27;Wow, this means that keybase stuff thinks that Zoom is secure already. Zoom should have hired people who don&#x27;t think that way.

<a href="https:&#x2F;&#x2F;pgp.mit.edu&#x2F;" rel="nofollow">https:&#x2F;&#x2F;pgp.mit.edu&#x2F;</a>

We have letsencrypt and permanent.org as non-profits. An idea of a identity and key non-profit sounds like another critical piece we would need for a free, open web

Keybase was dead as soon as they took VC money.Their original purpose — tying identities to keys — could have been a nice small non-profit. But there aren&#x27;t fortunes to be made from managing GPG keys, so they had to pivot into shark jumping.

Sounds like good timing that <a href="https:&#x2F;&#x2F;keys.pub" rel="nofollow">https:&#x2F;&#x2F;keys.pub</a> has become usable recently. :)

Keybase&#x27; post about the acquisition: <a href="https:&#x2F;&#x2F;keybase.io&#x2F;blog&#x2F;keybase-joins-zoom" rel="nofollow">https:&#x2F;&#x2F;keybase.io&#x2F;blog&#x2F;keybase-joins-zoom</a>&gt; What the Keybase team will be doing&gt; Initially, our single top priority is helping to make Zoom even more secure. There are no specific plans for the Keybase app yet. Ultimately Keybase&#x27;s future is in Zoom&#x27;s hands, and we&#x27;ll see where that takes us. Of course, if anything changes about Keybase’s availability, our users will get plenty of notice.&gt; So, our shortest-term directive is to significantly improve our security effectiveness, by working on a product that&#x27;s that much bigger than Keybase. We can&#x27;t be more specific than that, because we&#x27;re just diving in.So, yup, keybase is dead.

Make sure you sell your free Lumens before you delete your account. I got $55 a few months ago.

Anybody else having trouble deleting their account? When I go to &#x2F;account&#x2F;delete_me, I get redirected to &#x2F;?next=%2Faccount%2Fdelete_me, which is just the home page. Also, I get the logged out navigation bar even after logging in. Logging in seems to just redirect me to my own profile page. (I&#x27;ve got my content blockers disabled, etc.)Edit: deleting my cookies and re-logging in did the trick, in case anybody else hits this issue. After re-logging in I now have one fewer cookie than before, so I must&#x27;ve picked up an extra cookie that was screwing with their auth handler or something.

<a href="https:&#x2F;&#x2F;keybase.io&#x2F;account&#x2F;delete_me" rel="nofollow">https:&#x2F;&#x2F;keybase.io&#x2F;account&#x2F;delete_me</a>

Sounds like: stock price is high so use its value to its full extent while the price is high and more valuable. Allows selling&#x2F;granting of fewer shares of stock too.

I think the thought GP was expressing was that it would be a good time for Zoom to make an acquisition of Keybase paid for in Zoom stock since Zoom stock is trading at a very high multiple of Zoom&#x27;s earnings.Some people would regard this stock price as unsustainable compared to historic&#x2F;similar earnings multiples, and that the stock will likely decrease in value in the &quot;near&quot; future. So from Zoom&#x27;s perspective they may as well buy as much as they can while their Zoombucks are worth a lot since they&#x27;d be parting with fewer shares now than if they made the transaction later on.

Can you explain this in a little more detail please? Would love to understand more.

PE is price to earning, but if you look at earnings when is very low(barely making a profit), the number will be very high.  So people tend to project the Earnings a year or so, and it would fall drastically.

Zoom trading at ~1,700 P&#x2F;E which to me seems absurd.  Wonder if the acquisition involved much stock!  Seems like a good time for Zoom to make transactions like this.

If so, it would be in the unusual shape that it is a top-dollar one rather than cover-the-failure-with-a-pretty-ending one. But in this case, Zoom is probably actually interested in the security tech that Keybase has apart from the talent, they&#x27;re just not interested in the product.

Do &quot;acquihires&quot; work in practice? It reminds me of this Dilbert comic: <a href="https:&#x2F;&#x2F;dilbert.com&#x2F;strip&#x2F;2014-07-31" rel="nofollow">https:&#x2F;&#x2F;dilbert.com&#x2F;strip&#x2F;2014-07-31</a>

They are buying Keybase to shore up their security, why would they still give them time to keep it up unless, they want to also integrate their message service into Zoom chat.

I can easily see the words &quot;even more&quot; being added only after rounds of reviews :P

&quot;to make Zoom even more secure.&quot;
I mean, this might take a while.

Hi dang, are there any plans to introduce a marker of some sort so that people know whether the current URL is the same as the one it was submitted with? I find that often I have no idea what the comments are talking about

(We&#x27;ve since changed the URL from <a href="https:&#x2F;&#x2F;blog.zoom.us&#x2F;wordpress&#x2F;2020&#x2F;05&#x2F;07&#x2F;zoom-acquires-keybase-and-announces-goal-of-developing-the-most-broadly-used-enterprise-end-to-end-encryption-offering&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.zoom.us&#x2F;wordpress&#x2F;2020&#x2F;05&#x2F;07&#x2F;zoom-acquires-keyb...</a> to that one)

When I first heard of this purchase I thought, this is PR for Zoom to recover from its recent sec fails.

Keybase&#x27;s side of the announcement: <a href="https:&#x2F;&#x2F;keybase.io&#x2F;blog&#x2F;keybase-joins-zoom" rel="nofollow">https:&#x2F;&#x2F;keybase.io&#x2F;blog&#x2F;keybase-joins-zoom</a>&gt; What the Keybase team will be doing&gt; Initially, our single top priority is helping to make Zoom even more secure. There are no specific plans for the Keybase app yet. Ultimately Keybase&#x27;s future is in Zoom&#x27;s hands, and we&#x27;ll see where that takes us. Of course, if anything changes about Keybase’s availability, our users will get plenty of notice.&gt; So, our shortest-term directive is to significantly improve our security effectiveness, by working on a product that&#x27;s that much bigger than Keybase. We can&#x27;t be more specific than that, because we&#x27;re just diving in.They&#x27;re not even making the usual &quot;Zoom is committed to keeping Keybase alive&quot; promise :(

&gt; Zoom Acquires Keybase and Announces Goal of Developing the Most Broadly Used Enterprise End-to-End Encryption OfferingSo is this real end-to-end encryption, or Zoom-brand &quot;end&quot;-to-our-server-to-&quot;end&quot; encryption?

So does this mean getting marketed sketchy cryptocurrencies during your teleconferences, sending your PGP keys to random servers in other countries, ... or both?Relevant to the acquisition, perhaps: <a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191122031523&#x2F;https:&#x2F;&#x2F;github.com&#x2F;keybase&#x2F;keybase-issues&#x2F;issues&#x2F;788#issuecomment-46240258" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20191122031523&#x2F;https:&#x2F;&#x2F;github.co...</a>

I think we could just stop at:VC Funded™

I wonder if we’ll get a fully open source release of the Keybase server out of this. It would be so awesome as a federated ecosystem...

I don&#x27;t know their revenue numbers, but protonmail offers paid services, unlike Keybase. I hope protonmail doesn&#x27;t go the same path.

The reason for the death of cool software is that nobody pays for software anymore.

it&#x27;s more about the VC funding than anything else. it is almost always the reason for the death of cool software

I was very excited about first reports on Android. I was young, starting to earn my first money, and I wanted to spend that money by getting myself my first, awesome, Linux-powered smartphone by Google - a company I heard only good things about.Fortunately, I&#x27;ve decided to go with Openmoko instead back then. I&#x27;m so glad I did.

Same happened with Telegram: from a crypto messenger for geeks (who were excited by new crypto – I know, I know – and promises of end-to-end encryption everywhere coming some day) to just another messenger with cool stickers and stuff.Really sad because I personally recommended it too, and was hoping these things would work out somehow. Lesson learned: they don&#x27;t. The next messenger I will promote with my friends would be one without the server at all.

I don&#x27;t know how many people here remember the excitement when Android was new and, OMG, it&#x27;s Linux! Open source! Finally we have a Linux-based, free and open phone platform!I actually think that this played a non-trivial part in Android getting early traction - similar dynamic to Gmail where tech people got excited about it eventually &quot;my friend who&#x27;s good with computers recommends this&quot; becomes a factor.Not the exact same formula as you formulate above, but I think there are parallels to draw.Embrace, extend, and extinguish, and all that.

Can&#x27;t it be both a trend and a marketing strategy?

This is not a trend, it’s a long standing market strategy:<a href="https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Embrace,_extend,_and_extinguish" rel="nofollow">https:&#x2F;&#x2F;en.m.wikipedia.org&#x2F;wiki&#x2F;Embrace,_extend,_and_extingu...</a>

Indeed. We always knew that Keybase would have to find a source of income someway, get bought, or shut down.

Keybase packed together many different technologies in one place. I don&#x27;t think any of us who moved to Keybase had delusions that it would be around forever. But it&#x27;s an amazingly comprehensive suite for its small scope and the open source product that replaces it will only exist because Keybase existed.If the writing is placed on the wall (the marker cap is open right now) then replacing each of Keybase&#x27;s features with existing technologies won&#x27;t be difficult -- just time consuming, which is why they have market fit.

on the other hand, it was actually usable by somebody who isn&#x27;t a privacy advocate.the trend exists because &quot;pretty UIs&quot; and usability are actually valuable features to users, and the existing open ecosystems tend to fail at that aspect.

Keybase helped me to identify a trend in the software industry: using a pretty UI to cover up the disruption of an open ecosystem with a closed, centralized replacement. Keybase seemed cool on the face of it - making encryption easier is a laudible goal, and PGP certainly could use the improvement. But, thanks to Keybase, now I ask different questions upfront. Beware the Keybase formula:1. Integrates with an existing, open ecosystem2. May have open-source clients, but server is closed source and does not federate3. Pretty UI and good marketing4. VC funded

This is a good point. As far as I understood, Keybase&#x27;s main offering, i.e. key discovery for accounts you knew little about, was never about &quot;the best crypto that scales to Zoom levels&quot;.Though what the main features were got very muddled anyways, especially with the odd Stellar cryptocurrency wallet implementation. I&#x27;m very interested to see what they do with the existing tech, or whether there will be open-source forks that are somehow compatible.

from Zoom&#x27;s twitter:&quot;We are excited to integrate Keybase’s team into the Zoom family to help us build end-to-end encryption that can reach current Zoom scalability.&quot;not a word about what happens to the existing technology which doesn&#x27;t sound very reassuring to existing keybase users.

I essentially didn&#x27;t have a private key prior to Keybase, and I think it&#x27;s still the only place I use it, so I&#x27;ll end up rolling a new one if Keybase becomes fundamentally untrustworthy.

I signed up so long ago that I&#x27;m not quite sure what you mean. I remember posting a bunch of public keys (like on my profile here). I think the keybase app generated them along with a private key but it has been like three years.I don&#x27;t remember at all uploading one or where to find it if I did, can you explain the issue you have in mind a little more?

@Keybase users: Check if you uploaded your private key. I hope it is rare but now is the time to make that non existent.

It was actually a really nice stellar wallet implementation. A bad bet perhaps, in hindsight.  Unfortunately, this acquisition means I won’t be using it anymore for the foreseeable future.

I deleted my account when the crypto-spam emails started to arrive.

I saw that coming when they shoehorned a pointless cryptocurrency that nobody uses into it.

&gt; Ultimately Keybase&#x27;s future is in Zoom&#x27;s handsWell, that definitely translates to uncertainty and ultimately the death of Keybase.

People are expressing they will stop using Keybase because of this. That&#x27;s fine, probably a good idea.But reading this, Zoom+Keybase will make sure of this themselves. This press release indicates that this is a 100% acquihire. There&#x27;s only talk about what the Keybase people will be tasked to do, and there isn&#x27;t any talk about Keybase&#x27;s services in the first place. There&#x27;s no real reason Zoom would be interested in keeping Keybase&#x27;s services up and running anyway.Let&#x27;s hope they make it a swift death. Shame about Keybase, loved using it so far. It&#x27;s somewhat encouraging to see a change in direction for Zoom, too. Hope the acquihire works out.

This sounds like an acquihire, or am I reading it wrong? If so, I doubt anyone at keybase is necessarily thrilled about this.I’ve enjoyed keybase for many years, it made a lot of annoyances of encryption and key management easy. I particularly liked its encrypted git repo feature—now I’m struggling to think of an easy alternative.

I&#x27;ve used Keybase for a long time but I never quite understood the purpose of it. It never &quot;just worked&quot; for me and my experience was mostly chats being unreadable, my account having to be reset, and a lot of new functionality that seemed like it did what other products already did, just not as good.I always liked the idea and the people behind it seemed like good people, but I&#x27;m sad to say I won&#x27;t miss a worse version of Slack, Bitcoin and Dropbox.

Keybase was cool tech that for years I hoped would find a profit model and more everyday use case. I liked being able to prove I was in control of something on the web. I use Zoom for work and think it&#x27;s been one of the more stable video conferencing solutions out there but I certainly can&#x27;t trust them to maintain something like Keybase in a secure manner. Bye keybase, I know you had bills to pay and that this is a tough economy :( I hope your core team will be able to regroup after cashing out at Zoom with some new projects!

What are the best alternatives to Keybase?I&#x27;m curious about the encrypted filesystem, secure messaging that works on computers (non-phone), and public key trust.

Mergers and acquisitions make me so sad :&#x2F; I need to stop letting myself get excited about VC funded companies, because it always ends in disappointment. I really should know better by now!

Thats fair. And it‘s a much more interesting discussion IMO. Why is Keybase only really used for chat? I mean you can `keybase pull` all your friends’ pgp keys into your local keyring. It’s way way better than reading off fingerprints at a key-signing party. And yet that still didn&#x27;t lower the barrier enough for people to actually use crypto for shit. Maybe the key is email. Maybe Keybase missed an opportunity to bring email into the equation so everybody could do “web stuff” backed by social pgp without a second thought.

What I want is PKI that works for real people. Keybase was trying to be that, and I was really excited about it. But, that&#x27;s not what Zoom is selling. So Keybase being acquired by Zoom means what I wanted is dead.

Yes to all this.I&#x27;ve been juggling a lot of meetings between Zoom and my kid&#x27;s school on different platforms, and the difference between Zoom and Google Meet is night and day. Schools are mostly switching to the latter because of the security concerns, but damn is it terrible. It&#x27;s like Skype from 15 years ago.

Rough and unpolished, perhaps... but zoom is super popular because it&#x27;s dead simple and gets the job done, and all the big players could learn a lot from them about putting end users first and not trying to leverage them just to push other products.  To me the only question is whether Zoom will screw it up by emulating the mistakes that the big players have made.

Keybase was useless for the most part anyway. It became a vehicle to airdrop and shill shitcoins. Anyone saying it was some kind of bastion of user privacy is being overly nostalgic.

The missing piece here isn’t a factor driven by technical logic, but a factor by human logic.It was “cool” to use Slack until it became widely used, and then it was “cool” to use Keybase instead. Zoom is currently seen as “uncool” (E2EE screwup + widely used), so when they purchase “cool” Keybase, now Keybase automatically becomes “uncool” as well and people will look for something “cool” to migrate to next.This isn’t a complete explanation of all possible reasons, but it’s absolutely a contributing factor.EDIT: I predict Riot&#x2F;Matrix will be the replacement “cool” for Keybase.

Their client software locks up my machine every other day. You can’t screen share on wayland. My coworker can’t run a build while on a zoom call or his machine just dies. The UI has never scaled properly on my displays. The zoom icon is distorted in my task switcher. You can’t use zoom in the browser. It’s a lot of little things that add up. I’ll admit I’ve never used zoom on Windows. Perhaps they&#x27;ve invested most of their effort on that platform. And credit where it’s due, when the video calls work, they work as well as any.

Just out of curiosity, what was it about Zoom that never worked well for you? I work with oodles of academics, and that was the singular reason they flocked to Zoom - out of box ease of setup &#x2F; ease of use that trumped WebEx and GoTo Meeting.Privacy considerations were secondary and only came to light (from their perspective) during the increased scrutiny brought during COVID-19.

One scenario in which Zoom&#x27;s rep matter more, to me, is that they keep keybase alive, but now Zoom&#x27;s slop infiltrates keybase.In one way, good job Zoom for looking into security. In another way, I&#x27;m still looking at this awful UX that&#x27;s buggy as hell and thinking it&#x27;s gonna be a real slog for the keybase team to overcome that momentum.

Keybase is sitting on a potential vidconf goldmine heading to our brave newcov world. Keybase was sitting on top of a VC flush trapdoor opening to the abyss.Tech doesn&#x27;t matter nearly so much as market. Marrying better tech chops to better market potential is a rather better investor storytime.(Doesn&#x27;t mean it&#x27;ll work, doesn&#x27;t mean Keybase tech will, or won&#x27;t, survive. But the plave to be is Zoom&#x27;s niche with Keybase&#x27;s clue.)

&gt; Honest question, why does Zoom’s security reputation matter more than Keybase’s?Because Zoom is the buyer and they have the power. Sellers can make whatever promises they like (see: Whatsapp, Instagram) and it is reasonable to assume the buyer will have their way in the end.Zoom will certainly use Keybase to improve their security overall. However, the rather obvious lack of commitment to existing users means there likely won&#x27;t be any longterm.My prediction: Zoom integrates well with keybase, there&#x27;s a blog post that keybase is shutting down external services in a few months, the keybase founders leave and 1-2 years later, we hear of a new company they&#x27;ve founded.

Honest question, why does Zoom’s security reputation matter more than Keybase’s? There’s so much pessimism in here but I really don&#x27;t get it. I disliked zoom long before any of the security issues because frankly it’s rough, unpolished, software that’s never really worked well for me. I, for one, would be excited to get a functional Zoom with better security integrated into Keybase as an option for UI so that you have a serious “productivity” app. Why does the fact that zoom needs help in the security department automatically spell the end of times?

Mixed feelings, Keybase could become a &quot;modern&quot; Skype, but it may be the zoom is not that interested in the chat&#x2F;teams&#x2F;fs parts of Keybase...

I&#x27;m sure, I just found it amusing that it comes so soon after I directly asked about it!

Possibly because of the confidentiality agreements everyone signs at the start of an acquisition?

Oh wow, I had a guest lecture from Max Krohn yesterday in which I asked about how Keybase was being funded; no mention of this at all!

This. In fact I&#x27;ve found it pretty useful just for just personal files.There&#x27;s Tahoe-lafs, which ahs been around for years but, although secure was originally pretty notorious for being hard to use. Maybe it&#x27;s improves since...

I&#x27;ve found kbfs a very convenient way to share files with collaborators. Anyone know of a self-hosted encrypted remote filesystem that might replace it?

We&#x27;ve had per-room&#x2F;per-message retention policies in Matrix for months now (although Riot hasn&#x27;t exposed UX to configure them yet, as we were drowning in cross-signing work).<a href="https:&#x2F;&#x2F;github.com&#x2F;matrix-org&#x2F;synapse&#x2F;blob&#x2F;master&#x2F;docs&#x2F;message_retention_policies.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;matrix-org&#x2F;synapse&#x2F;blob&#x2F;master&#x2F;docs&#x2F;messa...</a> has the details.

Hijacking this: Does anyone know if there’s a Matrix client (out or in dev) that has the UI&#x2F;UX of old 1on1 messengers (ICQ, MSN) and not chatrooms (IRC, Slack)? Specifically not the weird list of bubbles on the side, but instead a list of accounts&#x2F;rooms and a window per chat.

Hi! I use Matrix a lot, but a privacy-sensitive group of my friends recently switched to Keybase largely due to the per-room&#x2F;per-message retention policies. This might be a good opportunity to convince them to jump ship, and I know something similar has been in the works for Matrix, but do you know where it is on the list of priorities?(Congrats on the cross-signing release though, it&#x27;s been a long time coming and it&#x27;s been working really well!)

There&#x27;s also Fractal[0] which uses GTK+ instead of Qt, and is maintained by the Gnome foundation and planned to be used by the Librem 5 AFAIK.[0]: <a href="https:&#x2F;&#x2F;matrix.org&#x2F;docs&#x2F;projects&#x2F;client&#x2F;fractal" rel="nofollow">https:&#x2F;&#x2F;matrix.org&#x2F;docs&#x2F;projects&#x2F;client&#x2F;fractal</a>

Alternatively Mirage[0] - Qt + Python. There is really a lot to choose from with Matrix. The beauty of open protocol.[0]: <a href="https:&#x2F;&#x2F;github.com&#x2F;mirukana&#x2F;mirage" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;mirukana&#x2F;mirage</a>

But unfortunately these alternatives don&#x27;t have the same encryption support, do they?  (Some seem not to have any.)

I was about to complain about your desktop Electron app but it seems that spectral[0] is already usable without any hassle (build from source, ...) at least on Fedora, time to reactivate my Matrix account, keep up with the great work0: <a href="https:&#x2F;&#x2F;gitlab.com&#x2F;spectral-im&#x2F;spectral" rel="nofollow">https:&#x2F;&#x2F;gitlab.com&#x2F;spectral-im&#x2F;spectral</a>

Matrix and Keybase have entirely different goals and functionalities. There&#x27;s barely any feature overlap besides end-to-end encrypted messaging, but it&#x27;s not like XMPP hasn&#x27;t had that for years. I think it&#x27;s silly to even compare the two

I&#x27;m not Arathorn (and not even a Matrix user yet, barely ever on Signal too), but the problem with bridges to 3rd-parties is that you&#x27;re effectively allowing these non-Matrix users to keep doing what they&#x27;re doing, instead of incentivising them to switch. The walled gardens know this very well - that&#x27;s why they&#x27;ve discontinued their XMPP gateways.

We&#x27;re working on making bridges better integrated in Matrix to help with this use case - it&#x27;s certainly a good way to drive uptake.On the other hand, bridges are always an impedance mismatch - you have to keep up with new features on both side of the bridge, and the system you&#x27;re bridging into doesn&#x27;t always want to be bridged.So, we think bridges are a key thing for Matrix (it&#x27;s where the name comes from - matrixing together different comms platforms!) - but it&#x27;d be wrong to predicate the success of the protocol on bridges. They&#x27;re useful, they have their place, but they&#x27;re not the sole reason to use Matrix.

I&#x27;ve been looking into Matrix as a &quot;personal IM bridge&quot; and I&#x27;m thinking this could be a way for Matrix to get traction.Let&#x27;s say you&#x27;re in a position that I think may here are: You would prefer to use IM in a secure way. Let me qualify &quot;secure&quot; for this purpose meaning: Encryption of communication in rest and transit; not relying on a single infra&#x2F;network&#x2F;service provider; being able to communicate with new peers easily without having to sign up with new providers; not requiring sign-ups leaking PIIs such as phone numbers; being able to sync message history across devices; all of this should hold for group conversations.matrix.org seems to be on the right track towards that. Feature-wise there&#x27;s some missing pieces in terms of federation but the roadmap looks like the ambition is right.But in practice, it&#x27;s realistically years until you can meet a random person in a bar and ask to join you on matrix to stay in touch, so many of us will still keep our accounts on the not-as-great platforms such as FB, Skype, WhatsApp, Signal.Given that, wouldn&#x27;t it be nice to facilitate using those platforms in a way that 1) absolves you from the behavioral tracking that comes with most of the first-party web- and smartphone apps and 2) integrates them in the same UI?There are, of course, solutions to this end. Bitblbee (IRC gateway), libpurple (pidgin, finch), third-party clients like franz. I&#x27;m sure there are many here who have or are using libpurple or bitlbee for this.But matrix also has bridges!I&#x27;m thinking one potential way that matrix could really get traction and seed the network infrastructure would be just that. Given stable gateways for the IM networks people already use, it&#x27;s suddenly a much easier sell to get enthusiasts and power-users to self-host matrix servers just to solve their own bridging needs and get a unified flow for disparate protocols.As that grows, eventually there&#x27;s a large spread-out flora of matrix servers that can become part of something larger.I think if there&#x27;s one thing that can make matrix succeed in it&#x27;s mission, it&#x27;s stable, feature-complete (or at least ticking the important boxes for the majority) bridges to mainstream services such as Facebook, Whatsapp, Signal, LINE, Skype, Google and Keybase.I think this should be a focus for Matrix, and amazing it would be to have these be the fruit of voluntary contributors, some funding is likely required if it&#x27;s to be sustainable as proprietary protocols and endpoints will inevitably break.What&#x27;s your take on that? I realize it&#x27;s a long comment and I&#x27;m in a bit of a rush, but I&#x27;d be really curious to hear how you think about these things.

Interesting. I&#x27;ve turned quite a number of non-technical friends&#x2F;family into Signal users, just by telling them, &quot;Here&#x27;s the messaging app I&#x27;m using if you want to talk to me...&quot; without mention of encryption until they&#x27;re already hooked. Uniformly comments have been favourable concerning ease-of-use and quality of voice&#x2F;video calls (at least compared to what they&#x27;re already used to -- generally Zoom or Skype), and several of them have pushed it out to their networks in turn.

Holy crap, the Matrix&#x2F;Riot teams have been busy! Congrats on the progress, it&#x27;s very exciting to watch. Although I have a Matrix account I have had trouble getting friends&#x2F;family to switch with me (mostly non-technical folks, and Signal was much stickier for them), it might be time to convince them to try again.Thanks to you and the team for all the hard work!

Matrix isn’t a company, it’s a non-profit foundation, expressly set up to protect its users: see <a href="https:&#x2F;&#x2F;matrix.org&#x2F;foundation" rel="nofollow">https:&#x2F;&#x2F;matrix.org&#x2F;foundation</a> for details.Riot is a Matrix client made by New Vector (<a href="https:&#x2F;&#x2F;vector.im" rel="nofollow">https:&#x2F;&#x2F;vector.im</a>), the company started by the team who originally created Matrix. The endgame there is to sell Matrix hosting (<a href="https:&#x2F;&#x2F;modular.im" rel="nofollow">https:&#x2F;&#x2F;modular.im</a>), support and other value-added services for Matrix. We are categorically not going to sell out our userbase - and we have no reason to; if we did, they’d just move to a different Matrix service provider.

What endgame do you think your company has other than eventually selling out its userbase in one way or another ?

It&#x27;s funny, but I think I get most of my Riot&#x2F;Matrix news from your comments scattered about hacker news.Anyway, I run a matrix server for my family (and we all use the Riot client) and the number one issue is encryption and mysterious &quot;Unable to Decrypt&quot; messages. (Closely followed by how rough the Android client is.) This fixes all of that (well, once RiotX replaces the standard Android client) and I think it will remove a lot of friction.Thanks for your work!

Yes, Matrix is properly end-to-end encrypted (with all keys generated clientside) and has been independently audited as such: <a href="https:&#x2F;&#x2F;www.nccgroup.trust&#x2F;us&#x2F;our-research&#x2F;matrix-olm-cryptographic-review&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.nccgroup.trust&#x2F;us&#x2F;our-research&#x2F;matrix-olm-crypto...</a>. We have gone to huge efforts to prevent MITMs via device verification and cross signing - which specifically addresses both problems of a) losing chat history when you move between devices (via <a href="https:&#x2F;&#x2F;github.com&#x2F;uhoreg&#x2F;matrix-doc&#x2F;blob&#x2F;e2e_backup&#x2F;proposals&#x2F;1219-storing-megolm-keys-serverside.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;uhoreg&#x2F;matrix-doc&#x2F;blob&#x2F;e2e_backup&#x2F;proposa...</a>) and b) requiring cross-signing when you log in on a new device, to spread trust to new logins, as per <a href="https:&#x2F;&#x2F;github.com&#x2F;uhoreg&#x2F;matrix-doc&#x2F;blob&#x2F;cross-signing2&#x2F;proposals&#x2F;1756-cross-signing.md" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;uhoreg&#x2F;matrix-doc&#x2F;blob&#x2F;cross-signing2&#x2F;pro...</a>.All keys are stored clientside, with the exception of if you enable serverside key backup, when they are then encrypted and optionally stored serverside to allow you to recover your history if you lose all your devices.

The thing I like about Keybase is that keys are always generated client-side and never leave the client, and all of the functionality associated with adding&#x2F;removing devices is done in a way so that there&#x27;s no way for a server to tamper with it (aside from denying service).Is that true in Matrix? Several services advertise themselves as &quot;end-to-end&quot; encrypted, but then when you poke harder it turns out either there is some sort of TOFU (so an opportunity for the server to insert itself) or else there is no device continuity (which means in the case of e.g. Whatsapp that keys are reprovisioned almost promiscuously to avoid bad UX). Whatsapp is a particularly bad example because (a) I lose chat history when I move devices, and yet (b) the UX does not require an old device to authenticate the new one, so I can compromise conversations (at least moving forward) if I can compromise a server.How end-to-end is Matrix really, and how similar is the new support to Keybase&#x27;s key management flow?

It&#x27;s kinda ironic that Keybase disappears into Zoom the day after Matrix&#x2F;Riot enabled end-to-end encryption by default, with cross-signed device verification similar to Keybase&#x27;s concept of connected keys - see <a href="https:&#x2F;&#x2F;blog.riot.im&#x2F;e2e-encryption-by-default-cross-signing-is-here&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.riot.im&#x2F;e2e-encryption-by-default-cross-signing...</a>.In other words, a fully open source (and open standardised) alternative continues to exist in the form of Matrix.[disclaimer: project lead for Matrix]

From the headline, I didn&#x27;t understand why Zoom, a videoconferencing company, would want to buy a secure messaging&#x2F;sharing app.But after reading it, duh. It&#x27;s an acqui-hire. Zoom definitely needs to improve it&#x27;s security, because of recently publisized problems. These are the right people to work on that, the security problems are similar in keybase and zoom, and an outside team with an established track record will help Zoom regain credibility. And Zoom probably had lots of cash on hand to buy whatever they wanted.So that all makes sense. I wouldn&#x27;t expect the keybase product to stick around though.Not because, as other commenters had said &quot;Zoom doesn&#x27;t care about security.&quot; Because they did an acqui-hire to get a team to help them with security, not because they wanted the product. I expect this will result in Zoom&#x27;s own security improving, it&#x27;s not some kind of smoke and mirrors trick. It&#x27;s not that they don&#x27;t care about security, I think they are presently prioritizing it. They just don&#x27;t care about the keybase product. Obviously, why would they? It can&#x27;t have revenue or profit anything close to what the zoom product has.

God, that cryptocurrency scam. If ever there was a clear message screaming &quot;we have no idea how to turn this into something profitable&#x2F;sustainable,&quot; that was it.

&gt; It&#x27;s a strange mix of instant messaging, web of trust, and cryptocurrency scam.They ended their Stellar airdrop early, but I guess it didn&#x27;t help that bots were joining the platform, and affecting the other parts of the Keybase community, just to get a share of it.

The product is simply not good in its current form. It&#x27;s a strange mix of instant messaging, web of trust, and cryptocurrency scam. It doesn&#x27;t strongly give any particular goal. The tools are shiny, pleasant enough to look at any use, but isn&#x27;t going in any direction.A lot of push recently has been into making it a &quot;team chat&quot; platform, which is great except that all of the participants are public, and tied to their name. It makes for hideously bad opsec if any company were to seriously use it.

Keybase went from ranking 30,000 to 65,000 in 3 months. What happened here? It seems like Keybase has been falling in traffic already for the past 3 months and it&#x27;s reputations has been tarnished in HN for months now.<a href="https:&#x2F;&#x2F;www.alexa.com&#x2F;siteinfo&#x2F;keybase.io" rel="nofollow">https:&#x2F;&#x2F;www.alexa.com&#x2F;siteinfo&#x2F;keybase.io</a>

Is there a viable alternative to keybase?

&gt; Engineer: Sir, it would be easier to just start over and build a video app for security from the ground up.&gt; CEO: But that would cost millions over the course of years!&gt; Engineer: Or we could just buy an already secure video app and put our features inside of that instead?&gt; CEO: Genius!And that&#x27;s how Keybase became Zoom.

On announcing that they&#x27;ll support git [1]:&gt; &gt; &gt; You guys should be taking my money&gt; &gt; One way to pay, if you want to help ensure their success &amp; longevity, is to evangelize for them, and get other people hooked on their product. Getting other people hooked on it like you are and seeing the potential and get over the adoption humps... that&#x27;s valuable! They&#x27;re not taking money because it raises the barrier to entry, and growth is most important. Pay them by helping them grow.&gt; It&#x27;s valuable, but not in the capital sense. Each person you get hooked on their product increases their burn rate, and both makes them more attractive as an acquisition (which is scary for users) and more desperate for cash (which makes acquiescing to acquisition more tempting).&gt; Without a road to profitability (or at least a road to revenue) even attracting equity is difficult; investors who enter with that knowledge will be looking to exit through acquisition, since that&#x27;s basically the only way to exit, other than just getting more capital.[1] <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=15403772" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=15403772</a>