2020-07-03-how-to-replace-keybase-in-three-easy-steps.gmi (6817B)
1 # How to Replace Keybase in 3 Easy Steps 2 3 Ever since Keybase was acquired by Zoom, a company with a very bad history with security/privacy, people wanted an alternative. There have been a few different alternatives proposed: this is (the best) mine. 4 5 First, a catalog of very bad links from Keybase's new owners: 6 7 => https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 An 0day in the macOS client! 8 => https://theintercept.com/2020/03/31/zoom-meeting-encryption/ Saying they use e2e when they don't! 9 => https://twitter.com/c1truz_/status/1244737672930824193 Using installing tricks from your local malware dealers! 10 => https://protonmail.com/blog/zoom-privacy-issues/ Protonmail has arrived to shit on them too! 11 => https://www.axios.com/zoom-closes-chinese-user-account-tiananmen-square-f218fed1-69af-4bdd-aac4-7eaf67f34084.html Shutting down people who talk about Tianamen Square! 12 => https://twitter.com/nicoagrant/status/1268020841054269440 Not encrypting free calls so they can snitch to the cops! 13 => https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ Rolling their own crypto! 14 => https://twitter.com/DanAmodio/status/1245329512889487361 Remember the installer from earlier? Now it has ACE! 15 => https://twitter.com/Ouren/status/1241398181205889024 Monitoring all the apps you have open! 16 17 ## What is Keybase? 18 19 Before we talk about replacing Keybase, we should have a good idea of what Keybase actually is. It's main features are as follows (ordered as on the website): 20 21 => https://keybase.io/ Keybase 22 23 * E2EE chats and messaging (people and teams). 24 * Cryptographic identity verification from around the net. 25 * KBFS (Public signed file hosting, private E2EE file storage w/ sharing, Static site hosting??) 26 * Git repositories? Crypto? An alternative to PGP called saltpack? 27 28 ## Previous Attempts to Replace Keybase 29 30 I'm not the first person to try this, obviously. Some brave folks have tried to build Keybase alternatives, such as keys.pub and the brand-new Keyoxide. I've tried both, but found that though they both are good in their own right, they are not the solutions that I am looking for. 31 32 => https://keys.pub/ keys.pub 33 => https://keyoxide.org/ Keyoxide 34 35 ## OK Time for the Steps 36 37 ### Step #1: Chat/Messaging 38 39 There are a few great pre-existing options for encrypted messaging: Signal, ProtonMail if you want to go full email, Telegram, and WhatsApp. However, they all have their problems (though I use the first two on a daily basis). Signal requires a phone number, and is more of an iMessage/text replacement than a Slack-style chat app. Protonmail is literally not chat – it's email. Telegram is (debatably) not secure. If you use WhatsApp for security you might be crazy – I only use it because it's *the way* to communicate with people in the Middle East and Africa. 40 41 Instead, I would recommend you use Matrix. Matrix is an "open network for secure, decentralized communication," and it's the perfect replacement for Keybase's chat. It utilizes E2E encrypted messaging, and can be self-hosted as well. 42 43 => https://matrix.org/ Matrix 44 45 In addition to a Matrix server, you also need a client. For this, I recommend Element – though Nio, once stable, will almost surely be my go-to. Element is a beautiful Matrix client with a bunch of awesome features, including Slack-like integrations, and apps for pretty much every major platform (Linux, MacOS, Windows, iOS, Android, and a web client). Plus it looks a lot like Discord. 46 47 => https://element.io Element 48 => https://nio.chat Nio 49 50 ### Step #2: Identity verification 51 52 Replacing Keybase's original function is probably the most difficult part of this tutorial: cryptographically verified identity proofs is a great and innovative idea. I would swap this out with an IndieWeb profile – one part of the larger microformats HTML structure. There are some pretty great tutorials out there, so I won't go into too much detail about exactly how to do that. However, it's important to note that though some tutorials recommend hiding your h-card with the display: none; property: don't do that. It's a documented anti-pattern. I just merged my about and contact pages onto my homepage, and added the microformats classes to my existing markup. 53 54 => https://indieweb.org/ The IndieWeb homepage 55 => http://microformats.org/ microformats homepage 56 => https://kevq.uk/how-to-create-an-indieweb-profile/ An Indieweb profile tutorial by Kev Quirk 57 => https://randomgeekery.org/post/2020/04/indieweb-h-cards/ Another Indieweb tutorial by Brian Wisti 58 => https://indieweb.org/antipatterns#invisible_metadata Invisible metadata antipattern 59 60 61 ### Step #3: File Storage 62 63 Replacing KBFS is easy to do, but hard to get right. Swapping to Google Drive is probably the move that most people would make, but that abandons the entire security/encryption aspect of Keybase. There's also Dropbox, but that has the same problems as above. ProtonDrive has potential, but it's not production ready. Enter Syncthing. Nikita Tonsky wrote one of my favorite posts of all time about Syncthing – go read it. One reason Syncthing is so great is that it's not the same thing as KBFS or any of the other "Drive" solutions. Instead of being a file hosting system, it's a "continuous file synchronization program" - aka p2p. You have no data limits other than your storage and no third-party to worry about. Plus, sharing folders is also incredibly easy. Just read the article. 64 65 => https://syncthing.net/ Syncthing 66 => https://tonsky.me/blog/syncthing/ Nikita Tonsky amazing article 67 68 ### Bonus Step #4: Video Calling 69 70 It would be a shame to talk about text chat, or really any form of communication, in this new pandemic age without talking about video chat. After all, the whole reason I'm writing this article is because the new videocalling giant Zoom. So, how have I replaced Zoom and how does that relate to replacing Keybase? Well, Matrix happens to have a fantastic Jitsi Meet integration. Plus, the folks over at Jitsi are working on E2E encryption for their calls. I've integrated Jitsi Meet into my self-hosted instance of Matrix, and now all my videocalls are just that – mine! 71 72 ## Summary 73 74 * Swapped chat to Matrix and Riot. 75 * Swapped identity verification to Indieweb. 76 * Swapped file storage/sync to Syncthing. 77 * Added videocalling to chat program via Jitsi. 78 79 ## Conclusion 80 81 Keybase is a great service, and the people who work there should be really proud of what they've built. However, given Zoom's aquisition of the company, the stability and security of the product have been called into question. So, ever one to hop on a hype train, I jumped ship. 82