Keybase iOS Has a Backdoor?
Official response here - I work for Keybase.<p>This article isn&#x27;t just misleading; it&#x27;s entirely false, and the title is both highly damaging AND false. Someone below threw out the word &quot;libel&quot; here. I don&#x27;t know about that, but it&#x27;s incredibly frustrating to read this title on HN right now.<p>* THERE IS NO BACKDOOR HERE.  Neither the especially scary kind suggested by the title (everyone assumes encryption breaking!), nor the coerced attestation kind suggested in the text.<p>* Put simply, KEYBASE HAS NOT BACKDOORED its apps and cannot coerce them into signing someone else&#x27;s Stellar address into a profile.<p>Further, THIS USER VOLUNTARILY GENERATED A STELLAR PRIVATE KEY.  What follows is the flow for generating a Stellar wallet and attaching it to one&#x27;s profile.  The author of this post went through this flow on Feb 4, 2019:<p>1. Visited the &quot;wallet&quot; tab in the app<p>2. read a brief description of Stellar in a modal.<p>3. Saw our disclaimer in a modal (not hidden - printed out front) about how scary cryptocurrency is, how it&#x27;s permanently attached to your identity, and how it&#x27;s important to backup your private key if you plan on leaving Keybase.<p>4. Only once they accepted that, then their client app (not our server) generated a Stellar private key. The app signed the public Stellar address into his sig chain. And the Stellar private key counter-signed, proving bidirectionally. The stellar key was then encrypted in a way so their devices could gossip them to each other.<p>So to be clear (1) this writer <i></i>did in fact have that Stellar Key<i></i>. And (2) we, Keybase, did not. And (3) they knew they were doing it. I encourage anyone curious to go try it out -- the flow has not changed.<p>I don&#x27;t understand what their agenda is here. Offering some charity, perhaps they went through this flow late at night and forgot. (Looks like they generated their Stellar account well after midnight in Europe.) But the claims in the post are just false.<p>I accept some people don&#x27;t like the opinionated cryptocurrency partnership Keybase has formed. We do like Stellar. However, that doesn&#x27;t change our security story. Nor does it force users to set up Stellar keys, and something like half of our users have not. Actually - we spent a great effort building around the fact that many users wouldn&#x27;t be interested in the cryptocurrency side of things.<p>For those who generate Stellar keys and then change their mind, not wanting them, we&#x27;ll add the feature to delete all of them.<p>Anyway, this is just not true. All of it.