#KEYBASE SERVER SOURCE INSTALL#
#KEYBASE SERVER SOURCE PASSWORD#
#KEYBASE SERVER SOURCE PLUS#

The 'burn all the computers' panic would make sense if the attackers used compromised Slack servers to install keyloggers on end-user systems. And as soon as their control over that server ends, they're locked out, knowing the cookie or public key doesn't let them pretend to be a user, nor does it let them pretend to the user that they're the real server. So bad guys who have access to a server can steal the cookie, and the public key, but neither of those is secret, they're useless to anyone else. It promises that in future when told the same cookie again it will sign a new message to prove it still knows the private key.

#KEYBASE SERVER SOURCE PLUS#

In U2F's enrollment process the user's Security Key hands over a 'cookie' and a public key minted for this enrollment, plus a message signed with that key to prove it knows the associated private key. But U2F isn't like that, something way cleverer happens. The server must learn what the secret is, albeit for passwords it usually tries to forget again soon after, as part of the authentication protocol. This means there's no way to 'steal' durable access, as was done with passwords and would be possible with technologies like TOTP or SecurID tokens.ДЄll those technologies rely on a secret. In U2F the server (where these bad guys apparently had control back in 2015) doesn't know any secrets about the authenticated user. No cancelled ski trip, no bad guys getting into the 'definitely not for researching the competitor product' Slack account, no expensive computers trashed, no blog post with opportunity to grow your customer base, er, I mean, tell a funny story. If Keybase's Slack account had been secured with U2F nothing would have happened. I'm here because in the middle of his fun story about supposedly throwing away a lot of expensive gear in a panic Max says 'If the attackers inject server code, 2FA or U2F or any Web-based security practice does little' which is completely wrong, and ought to give pause to anybody who has been following along thinking 'This Max guy seems to know what's up'. I'm not going to rehash why you're silly about Signal. Previously, previously, previously, previously, previously. It is sure as shit better than Signal: it doesn't leak your phone number, and is actually open source. Setup is definitely complex, but once its running, it's good at what it does - which is to say, IRC channels with end to end crypto, but also mission-critical EMOJI. I've been lightly using Keybase for a little while now. I can't see any good reason to choose Slack over Keybase unless you are making the decision that you want the slider between 'convenience' and 'security' to be wayyyyyy over to the left. Now, grain of salt and all, being from a competitor, but I'm with Keybase on this one. A break-in our of our servers, even one injecting code, cannot yield unencrypted messages or jeopardize message integrity. Keybase messages are end-to-end encrypted, and only our users control their decryption keys. Were our Dutch friends sifting through our messages for four years before Slack notified us of a suspicious login? ДЄlso, Slack's announcement seems to say 1% of accounts were still compromised (after 4 years), but we are wondering: how many were compromised then? And what percentage of messages did the compromised accounts have access to? 10%? 50%? Only the hackers know, but it's likely much more than 1%.ДЄnd finally, we know the original compromise was in 2015, but I was only notified of a suspicious login in 2019. But with these things, you can never know for sure. In the end, I was pretty sure but not 100% convinced that if I had been 'rooted', that the attackers couldn't follow me to my new setup.

It cost Keybase and me a lot of time, money and stress. In the subsequent days and weeks, I reset all of my passwords, threw away all my computers, bought new computers, factory-reset my phone, rotated all of my Keybase devices (i.e., rotated my 'keys'), and reestablished everything from the ground up. The CEO of Keybase has some things to say about this: The breach wasn't just of encrypted passwords but also injected a key logger to capture plaintext passwords.

#KEYBASE SERVER SOURCE PASSWORD#

Apparently Slack had a massive breach back in 2015 for which they are only just now issuing password resets.

Keybase server source