HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
keybase
keybase-issues
Web Development2014–2026
keybase / keybase-issues

keybase-issues

A single repo for managing publicly recognized issues with the keybase client, installer, and website.

Web Development
Explore on GitHubRead Hacker News discussions
35Distinct people
38Mentions
0Explicit recommenders
899GitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A single repo for managing publicly recognized issues with the keybase client, installer, and website.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year38 dated mentions

Observed mentions: 2014-03-19 16:39:02 UTC to 2026-03-11 21:37:01 UTC.

02462014-01-01 00:00:00 UTC to 2015-01-01 00:00:00 UTC (exclusive): 6 mentions; 2 submissions, 4 comments20142015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 5 mentions; 1 submissions, 4 comments2016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 7 mentions; 0 submissions, 7 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 1 mentions; 1 submissions, 0 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-01-01 00:00:00 UTC to 2027-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments. Incomplete calendar period.2026*

* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20142014-01-01 00:00:00 UTC2015-01-01 00:00:00 UTC624
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC514
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC303
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC707
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC505
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC505
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC303
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC000
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC110
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC101
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC000
2026 (partial)2026-01-01 00:00:00 UTC2027-01-01 00:00:00 UTC101

From the project README

An excerpt from the repository, fetched Nov 13, 2026.

Read the project’s introduction
Client-side (app) bugs: If you've installed Keybase on your desktop, run: keybase log send and follow the instructions. If you're on a mobile device, please just post to client issue tracker. Serious security bugs We have a bug bounty program on HackerOne, please report there. Everything else, including website bugs, ideas and suggestions There's an issues tab on this page. If you'd like to review our code We'd like that too. https://github.com/keybase/client - the client for all platforms Hall-of-fame Bugfinders Michael Henriksen S. Venkatesh Leigh Thanks!
Read the full README on GitHub

What Hacker News says

38 sources
westurner·Mar 25, 2023
WKD also lacks key revocation and CT Certificate Transparency. E.g. keybase could do X.509 like Certificate Transparency. : $ keybase pgp -h NAME: keybase pgp - Manage keybase PGP keys USAGE: keybase pgp <command> [arguments...] COMMANDS: gen Generate a new PGP key and write to local secret keychain pull Download the latest PGP keys for people you follow. update Update your public PGP keys on keybase with those exported from the local GPG keyring select Select a key from GnuPG as your own and register the public half with Keybase sign PGP sign a document. encrypt PGP encrypt messages or files for keybase users decrypt PGP decrypt messages or files for keybase users verify PGP verify message or file signatures for keybase users export Exp
Read the rest
ort a PGP key from keybase import Import a PGP key into keybase drop Drop Keybase's use of a PGP key list List the active PGP keys in your account. purge Purge all PGP keys from Keybase keyring push-private Export PGP keys from GnuPG keychain, and write them to KBFS. pull-private Export PGP from KBFS and write them to the GnuPG keychain help, h Shows a list of commands or help for one command $ keybase pgp drop -h NAME: keybase pgp drop - Drop Keybase's use of a PGP key USAGE: keybase pgp drop <key-id> DESCRIPTION: "keybase pgp drop" signs a statement saying the given PGP key should no longer be associated with this account. It will **not** sign a PGP-style revocation cert for this key; you'll have to do that on your own. /?q=PGP-style revocation cert https://www.google.com/search?q=PGP-style+revocation+cert : - "Revoked a PGP key, is there any way to get a revocation certificate now?" https://github.com/keybase/keybase-issues/issues/2963 - "Overview of Certification Systems: X.509, CA, PGP and SKIP" ... - k8s docker vault secrets [owasp, inurl:awesome] https://www.google.com/search?q=k8s+docker+vault+secrets+owa... https://github.com/gites/awesome-vault-tools - Why secrets shouldn't be passed in $ENVIRONMENT variables; though e.g. the "12 Factor App" pattern advises to parametrize applications mostly with environment variables that show in /proc/pid/environ but not /proc/pid/cmdline W3C DID supports GPG proofs and revocation IIRC: "9.6 Key and Signature Expiration" https://www.w3.org/TR/did-core/#key-and-signature-expiration "9.8 Verification Method Revocation" https://www.w3.org/TR/did-core/#verification-method-revocati... Blockerts is built upon W3C DID and W3C Verified Credentials, W3C Linked Data Signatures, and Merkel trees (and JSON-LD). From the Blockerts FAQ https://www.blockcerts.org/guide/faq.html : > How are certificates revoked? > Even though certificates can be issued to a cohort of people, the issuer can still revoke from a single recipient. The Blockcerts standard supports a range of revocation techniques. Currently, the primary factor influencing the choice of revocation technique is the particular schema used. > The Open Badges specification allows a HTTP URI revocation list. Each id field in the revokedAssertions array should match the assertion.id field in the certificate to revoke. Re: CT and W3C VC Verifiable Credentials (and DNS record types for cert/pubkey hashes that must also be revoked; DoH/DoT + DNSSEC; EDNS): https://news.ycombinator.com/item?id=32753994 https://westurner.github.io/hnlog/#comment-32753994 "Verifiable Credential Data Integrity 1.0: Securing the Integrity of Verifiable Credential Data" (Working Draft March 2023) > Security Considerations https://www.w3.org/TR/vc-data-integrity/#security-considerat... If a system does not have key revocation it cannot be sufficiently secured.
In We updated our RSA SSH host key
windthrown·May 7, 2020
You are referring to this Github Issue: https://github.com/keybase/keybase-issues/issues/788 "Yes, we sold our previous 2 businesses. But I want to point out that (1) neither of those sales ever hurt (and arguably both sales greatly helped) our users, (2) Keybase deserves special consideration which we are aware of, and (3) both Max and I are happy in a world where we never try to sell a company again, and only build things we like." I feel silly for falling for it too. Even very wealthy people enjoy extra money.
In Zoom Acquires Keybase
mjlee·Jun 28, 2019
This dates back to 2014, but there's an GitHub issue with an answer to this question: https://github.com/keybase/keybase-issues/issues/788 Slightly more recently in 2015 there was this blog post: https://keybase.io/blog/2015-07-15/keybase-raises-series-a The salient point is: > In two simple steps: (1) we hope to earn a reputation for creating superior, simple crypto clients. > Then, (2) some people may turn to us for more advanced, hosted solutions. That could be anything from team management (in the enterprise) to hosting of public, signed files. > On this second idea, we are already working on something big and filesystemy, designed to address pain points for developers first. That product will be free for everyone, unless you need massive storage.
In Experimental Slack-to-Keybase team importer
lrvick·Mar 12, 2019
I have researched their approach in great detail and found design flaws in it like: https://github.com/keybase/keybase-issues/issues/1946 A lot of trust is rooted in their centralized proprietary walled garden API and to make matters worse they actually silently bypass hardware security modules in favor of keys exposed to system memory! They even encourage users to expose their PGP private keys to their browser and didn't even bother to isolate it to a service worker so browser plugins can't steal it (or just supporting hardware tokens which GPG already did just fine) Almost everything they do is non standard, not interoperable with anything else, not distributed to keyservers. They are the internet explorer of cryptography. They did this in the name of UX but it turns out you can have super easy PGP UX AND follow standards as OpenKeychai
Read the rest
n has demonstrated. Keybase introduced lock-in and their own protocols for problems that did not at all need them. They are 2 steps forward on UX and one huge backwards step for security.
In Cryptographic coin flipping, now in Keybase
lrvick·Sep 7, 2018
Keybase also silently subverts smartcards for in-memory keys per my findings here: https://github.com/keybase/keybase-issues/issues/1946 In general I find Keybase to be a step forward in user experience and two steps backwards in terms of actual security. They just don't seem to care about the latter at all and have not demonstrated any cooperation with standards bodies like the OpenPGP working group where members have expressed interest multiple times in adding generic URL uids to the openpgp public key itself to replicate and decentralize the idea of social media based trust bootstrapping (the one good idea from Keybase in spite of terrible execution). Instead they insist on their complex proprietary walled garden system that does not integrate with existing keyservers and throws everything on the bitcoin blockchain for reasons. Keybase
Read the rest
has become the IE of crypto and I can't take any security project seriously that even -integrates- with them.
In Keybase’s browser extension subverts its encryption
eridius·Jun 22, 2018
A comment in your [1] link points at https://github.com/keybase/keybase-issues/issues/1952#issuec... which explains why device names are immutable. > The reason of this restriction is pretty important: we want people to be able to think of devices by name - say, when seeing them in a list, or when talking about them - and never have to think about key fingerprints or id's. The only way to achieve this safely is to make a device<->name map immutable and global, using the sig chain. Otherwise there are endless caveats and visual explanations needed showing the evolution of a device name over time. > Consider: if an intruder steals one or more of your keys and starts doing crap to your sig chain, they still can't change the definition of "iphone6s-white". It is set in stone, which is crucial to maintain the abstraction that "iphone6s-white"
Read the rest
is a certain key. I agree that it sucks to have your device name become permanently unusable; I've hit this myself a few times, and it's mildly annoying to find that I have to pick a new device name in Keybase even though my local name for the device hasn't changed. But removing this restriction opens up a security vulnerability.
In Keybase Exploding Messages
mholt·Jun 20, 2018
I had to stop using Keybase after this issue [1] cropped up: when you re-install your OS, you lose access to the "device" and have to provision a new one, even though the machine is the same, and even in possession of an uncompromised private key. Apparently this happens a lot [2-7... probably more]. Unfortunately, this renders Keybase unusable for me because, even though I still have my private key, I cannot access my laptop's Keybase when I install it. [1]: https://github.com/keybase/client/issues/3460#issuecomment-2... [2]: https://github.com/keybase/client/issues/3559 [3]: https://github.com/keybase/keybase-issues/issues/1952 [4]: https://github.com/keybase/keybase-issues/issues/1985 [5]: https://github.com/keybase/client/issues/4260 [6]: https://github.com/keybase/client/issues/2357 [7]: https://github.com/keybase/client/issues/2675
In Keybase Exploding Messages

Showing the 15 most recent of 38 sources. Enable JavaScript to search and browse every indexed mention.

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.