[minitech]

It’s only useless if you don’t know what perfect forward secrecy is and would rather complain than look it up. Yes, this feature is provided by Telegram and Signal (probably WhatsApp too). It makes it so someone who compromises your key can’t read all past messages. It’s pretty important. Future secrecy (key compromise doesn’t grant access to all future messages) is also important. Keybase only has forward secrecy for its exploding messages.

These are why I’d never use Keybase to chat even though it’s better than Signal from a usability perspective.

[balboah]

Could you sum up how someone is able to read keybase exploding messages when a key is compromised? After it explodes

[JshWright]

If an attacker obtained the ciphertext of the message, they are under no obligation to delete it just because it "exploded" on your device. They can hold onto it as long as they want, then if they ever get your key, they can decrypt it.

[tialaramex]

So, firstly the comment you're replying to specifically says that Keybase _does_ use PFS for exploding messages. I'm going to assume in good faith that you've simply misread the comment but I'll circle back on this because the technical details are interesting.

1. For _other_ Keybase messages without PFS it's open season. Say Alice sends you a normal Keybase message right now about murdering her husband Bob. Keybase will ensure Alice provides keys to decrypt that message for your iPad, iPhone, the MBP and your old Thinkpad. This way you can read the message from any of your devices. Convenient.

Spooks can record Alice's encrypted message and get it back if they at /any/ subsequent point obtain the Keybase device key for your iPad, iPhone, MBP or Thinkpad, for example as a result of seizing it for some other reason. Maybe it's next week, or next month, or next year, or in ten years time. The device may never have received these messages, maybe it was switched off, or they've since been removed. Doesn't matter until the key is replaced.

In contrast a PFS system would discard the keys as soon as they'd been used to decrypt stuff, and agree new keys for subsequent messages. Signal's double ratchet does this for every single message back and forth. "I killed Bob" (new key) "You did what?" (new key) "I was so angry I just stabbed him" (new key) "Shit. Now what?" (new key) and so on.

2. Actually though "exploding" messages are another Keybase compromise. Visually it seems like they blow up instantly when the time limit expires right? Gone. But cryptographically it takes up to a month or so for the bomb to "explode". Suddenly it's more like you wrote the message in chalk on an outside wall rather than it instantly "exploding". This was easier for their multi-device large group stuff. That's right, your 1 hour exploding message about the lawsuit was optimised for cases where you'd need to share it with a 500 person group who all have multiple devices. That makes sense right?

Always with "exploding" messages the actual expiry is implemented by some software explicitly deciding to throw ephemeral data away. Signal's ratchet makes doing so constantly the unavoidably the correct software engineering choice, otherwise your code leaks endless old keys because of the ratchet. But Keybase only throws away "ephemeral" keys after at least a week, chances are if you're a multi-device user there are some fortnight old "ephemeral" keys in one of your systems right now. A Keybase exploding message you got on the 1st of December with a one hour "fuse" on it is still actually readable now using keys from that device. Huh. The Keybase UI doesn't make that apparent at all.