Covert Contact 69: Securing Data, Communications, and Identity with Keybase

In this June 2017 conversation, Keybase co-founder Max Krohn joins me to discuss making encryption easier to use and connecting online identities to cryptographic keys. I had used Keybase and followed its development from an identity directory into a service offering encrypted chat, file sharing, and applications across multiple platforms.

Max explains the idea behind linking accounts people already recognize, such as Twitter and GitHub handles, to a cryptographic identity. The aim is to help people check whom they are communicating with before exchanging private information. We also discuss the practical difficulty of managing keys across devices and Keybase's move away from its early password-based approach toward device-held secret keys.

The conversation explores a broader use for this infrastructure: verifying the source of published material. Using the reported Qatar News Agency hack as a starting point, we consider how digital signatures could help authenticate articles, software, and other communications. Max emphasizes an important limitation: a compromised device can still allow an attacker to impersonate its owner.

We also look at the deliberate pace of development, open-source scrutiny, mobile applications, and plans for richer team collaboration. Max describes the challenge of building a durable record of identity and device changes while keeping the experience understandable to people who do not want to manage cryptographic details themselves.

We close with the tension between privacy and the needs of law enforcement and intelligence agencies. Max argues for protecting ordinary users against data theft and impersonation, while acknowledging that encryption does not solve the problem of access to a compromised endpoint.

This episode was originally released on June 8, 2017. Product features, development plans, and security assessments reflect the discussion at that time.