Keybase and the chaos of crypto
A little privacy. Some blockchain. And a lot of anarchy, spam and abuse.
Today, it’s nearly impossible to have a truly private conversation online. Someone is always listening: either the company providing the chat service, or governments (Normcore post), or third parties who want to scoop up data.
For example, you could try Facebook Messenger. But Facebook automatically scans these messages for abuse and combs through them manually for other, random pieces of information. You could try Whatsapp, but that’s now owned by Facebook which means, in spite of end-to-end encryption, Facebook could potentially still be accessing that content. (Whatsapp founder Jan Koum specifically left Facebook over privacy concerns.) You could use iMessage, which is in theory secure (if you trust Apple’s newfound market-based commitment to privacy) unless you message someone on Android. Signal is wonderful but a huge headache to use. Telegram is my messenger of choice, but their cryptographic algorithm is still under question.
The Origins of Keybase
What to do? In 2015, Max Krohn and Chris Coyne, two of the founders of dating site OKCupid, found themselves wondering the same thing. They left OKCupid and started working on an app that was oriented towards a need for privacy.
When my co-founder Chris Coyne and I were working on OkCupid, we were surprised by how willing our users were to entrust their most deeply personal data to the site. We had good reason to collect that data – so we could match people – but we spent a lot of time and effort thinking carefully about how to best protect it. We knew that privacy would be a growing concern because, at that time, people hypothetically knew that the internet wasn’t secure, but they also widely believed that individuals didn’t have the wherewithal or interest to exploit the insecurities.
They initially built a directory of PGP keys (cryptographic keys that you can use so that no one can decrypt your communication with someone else) that became popular through Twitter. They then decided to flesh out the concept so that users could also use the platform to have secure, encrypted chats, and so that they could also chat with people who had verified their identities with Keybase through other platforms like GitHub, Twitter, and Reddit.
Eventually, they built out social features:
On top of this foundation, we’ve also built encrypted chat, file sharing, and Git on a single platform that works across all of your devices – so, you can think of us as Slack/Dropbox combined and encrypted (or Signal with support for large groups).
And then the VCs came calling. Andreessen Horowitz invested in 2015. If you’ve been reading Normcore long enough, you know what happens when VCs come around: it’s time to grow quickly or die. VC investment has, so far, ruined Reddit (Normcore post), Twitter (Normcore post), and Imgur (paid Normcore post). That’s exactly what’s happening now with Keybase (with a bonus splash of cryptocurrency fever).
I first created a Keybase account in 2017, when the company was introducing interesting features like Teams (a group chat) and support for exploding messages, which are deleted from the platform after you view them. These are great for sharing pictures you don’t want to become public, or deleting what you’ve said so the internet doesn’t remember your every word.
The founders were emphatically pro-privacy in the press, and they were introducing cool features. Everything was going great.
Then Stellar got involved.
Our Series A was from Andreessen Horowitz in 2015. That money lasted us until about 2018, when we would have done a Series B. But instead of doing a Series B, we were lucky enough to enter into a multi-year partnership with SDF. We’ve been able to make our money last because we try to keep our expenses low on most fronts. For example, we’re in a WeWork instead of building our own space. We spend on hiring and supporting the best people we can find to build Keybase. Chris and I are still very much involved in the day-to-day engineering. *Fun fact: We have only one employee who’s not an engineer or designer.
Our future plan to monetize is based on a freemium model – similar to how we monetized OkCupid, except Keybase won’t have ads. For the time being, we’re really just focused on getting as many users as possible. When we reach a point when we need more revenue, we’ll start charging our corporate users for certain features.
Cryptoca$h
Stellar is, essentially, a platform that converts cryptocurrency into money like dollars and Euros, because transferring cryptocurrency to fiat currency like dollars is a complicated process.
If you’re a little hazy on the world of cryptocurrency and blockchain, you’re not alone. Before I did the research for this post, I basically imagined it as an enormous scam glued together by buzzwords. I still do, but at least now I know about the internals.
It first helps to understand how modern money works, at least in America. Money is, basically, a medium of exchange. You can exchange dollars for a Normcore Tech subscription (cough). Or some ice cream. Or Amazon kipple (Normcore post). And so on. Money has no intrinsic value of its own. But the government backs money, which is why it’s called fiat currency. We are all exchanging money for stuff based on the belief that the US government is stable and will continue to be so. All of the money is issued by the Federal Reserve (and printed by the Bureau of Engraving and Printing), which tracks and controls how much is in circulation. Banks keep the money and verify transactions. This means that any monetary transactions with banks, credit cards, stocks, etc, are tracked by the government and financial institutions.
Cryptocurrency is, in theory, also money. Or, more accurately, it’s a digital medium of exchange that doesn’t go through any central processing authority. It has nothing to do with the Federal Reserve or any banks. Because there is no central governing body that regulates and tracks it, the transactions are verified by math instead.
This math is the blockchain, also called a ledger. It’s basically a really long and complicated appendable log (Normcore link). The Federal Reserve issues dollars. Cryptocurrency is issued when any given entity decides to give out money, in this case, the Stellar Foundation’s Lumens. As the site says, “One hundred billion Lumens were created the instant Stellar went live, as part of the protocol’s design.”
You can get Lumens by buying them on cryptocurrency exchanges, like Coinbase. Or, other people can give them to you and you can put them in your crypto wallet. Or, the organization creating the currency can give them to you directly.
That’s all well and good, but how can you transfer the Lumens to something you can use, like dollars or Euros? Here’s where it gets a little complicated. You first have to convert the Lumens to another, more established cryptocurrency, like Bitcoin or Ethereum, and then sell those on an exchange like Coinbase for dollars. (Coinbase just started supporting Stellar in March.) It’s a lot of steps and you’re gonna have to pay taxes on it, which also gets hairy.
So while Lumens are cash in theory, the steps to get from Lumens to actual dollars are long and varied.
Stellar
But where did Stellar come from? There are already so many cryptocurrencies out there - why another one? Here’s where it gets interesting. Stellar, both the currency and the foundation, was started by Jed McCaleb, one of the founders of Mt. Gox, a bitcoin exchange run out of Japan. In 2014, Mt. Gox filed for bankruptcy after it was attacked by a third-party. There is a whole fun backstory that you can read in your free time because if I go deep on this we’ll never get to the actual point of this newsletter.
Ok! So Mt. Gox went bankrupt and McCaleb, a serial entrepreneur, started Stellar, which was funded by the payment company Stripe, to the tune of $3 million dollars.
The new company’s board consists of ex-PayPal executive Keith Rabois, Y-Combinator’s Sam Altman, WordPress owner and Automattic CEO Matt Mullenweg, and AngelList co-founder Naval Ravikant.
“Stellar’s goal is to build a great transport layer for transmitting monetary value,” Stripe CTO Greg Brockman wrote in the Stellar blog.
“Figuring out how to efficiently move money is something we support very strongly: Stripe spends a lot of effort integrating different banking and finance protocols in various countries (17 at last count).”
Brockman said the Stellar team is bullish about the cryptocurrency space in general and expects multiple systems to prosper.
“When the opportunity arose to help Stellar, we enthusiastically agreed. A couple of months ago, Stripe contributed US$3m to help get the project going. In return, we received 2pc of the stellars.”
(BTW, remember Brockman? He later became the CTO at OpenAI (Normcore post).)
So now, effectively Stellar became a cryptocurrency backed by Stripe, which means that Stripe invested in Keybase. Who invested in Stripe though? Andereessen Horowitz (which, as a reminder, now funds Substack, the platform Normcore is coming to you live from - and which is also powered by Stripe payments), and other VC firms.
So basically, we have Keybase first funded by A16Z, then again by A16Z (but indirectly, through Stripe, by way of the Stellar Foundation). If all of this sounds slightly sketchy and annoying, welcome to the world of VC and cryptocurrency in 2019.
The Airdrop
How did this impact me? Because not long after Keybase announced their partnership with Stellar (aka funding), they announced something known as an Airdrop of Lumens to all Keybase users.
The Stellar Development Foundation and messaging service Keybase announced Monday a 2 billion XLM airdrop, the largest in Stellar’s five-year history, worth roughly $120 million. Over the next 20 months, Keybase users can expect monthly airdrops of 100 million XLM.
Keybase currently has 300,000 active users across its various services, according to the company.
“All you have to do is have an authenticated Keybase account, and your XLM will appear in your wallet – automatically, every month, for as long as the airdrop continues,” according to a draft blog post shared with CoinDesk.
Stellar Development Foundation CEO Denelle Dixon tells CoinDesk that Keybase is a key part of its larger adoption strategy:
“The foundation’s mandate is to deliver lumens [XLM] into the world. This is part of that plan. The up to 2 billion is a really great way. And we will have checks along the way.”
It doesn’t take a cryptography expert to imagine what would happen when you combine what sounds essentially like “free money”, the confusing internals of cryptocurrency, and a messaging platform where you only have to verify your identity using a cryptocurrency wallet: rampant platform spam and abuse.
I didn’t predict it, but the founders of Keybase should have seen this coming. They cut their teeth on the social internet at OKCupid. They had they seen what being a woman on a social site was like - very hard, with incoming messages often flooding women’s inboxes and overwhelming them.
They also understood that drastically changing a platform was the Wild, Wild West. You never knew what would happen when you tried something on the internet. Co-founder Christian Rudder (who I was at an event with a couple years back), hosted a quirky and somewhat controversial blog showcasing his learnings about humans after analyzing OKCupid data. (The site was deleted and later resurrected.) One of the articles read,
But OkCupid doesn’t really know what it’s doing. Neither does any other website. It’s not like people have been building these things for very long, or you can go look up a blueprint or something. Most ideas are bad. Even good ideas could be better. Experiments are how you sort all this out.
But somehow they didn’t understand that crypto would lead to chaos.
The Aftermath of the Airdrop
The way the Airdrop was supposed to work was this: First, Keybase users received a surprise airdrop, which ended up being the then-equivalent of $20 in Lumens; after that, everyone who joined the Keybase platform would receive something like the equivalent of $40 if they signed up and connected to an existing GitHub or Hacker News user account. And they would continue to receive Lumens every month thereafter.
Even after those major caveats and theoretically some level of airdrop design, the Keybase platform exploded in pandemonium.
First, a series of bad actors tried to game the system by brute-forcing both Hacker News and GitHub, and Keybase had to stop qualifying new users based on those accounts,
UPDATE #2 September 16: HackerNews and GitHub were both under attack by bad actors who hoped to game this by stealing other users' accounts. In cooperation with both of those sites, we've halted Space Drop registration for anyone who wasn't a Keybase user before Sept. 9. SDF and Keybase will discuss, while whining and moaning, how this giveaway can continue. (COME ON PEOPLE OF THE INTERNET, STOP SUCKING SO MUCH!) https://keybase.io/a/i/r/d/r/o/p/spacedrop2019
Then, people overwhelmed Max and Chris with questions about the Lumens.
And, while they were firefighting, the enormous influx of new users meant that current users started to get a lot of spam related to bad actors coming onto the platform - a kind of very horrible eternal September. All of a sudden, I started receiving lots of random messages from people without profile pictures.
These were people I didn’t know contacting me on a pretty frequent basis, and I had no way to opt-in to their messages. Pretty ironic for a platform built on privacy.
I wasn’t the only one. After asking around, it seems that everyone I knew on Keybase was getting these. But of course, women with female names and profile pictures got a lot more than most men I knew. Other women online were experiencing it, too:
Meanwhile, I was trying to do some investigative journalism and find out why randos were sending me messages. As you can imagine, it didn’t go too great.
The most interesting chat was this one, where I realized that people were finding me from the “Consider following” tab on Keybase, which as far as I can tell from the Keybase code on GitHub comes from suggested contacts based on the social networks you’re connected to. Users had previously asked Keybase to disable this feature.
For women in particular, this kind of encounter is accompanied by with wariness and a sense of invasion of personal space, especially in an online world where they are already constantly wary of possible harassment and stalking.
And, not only were people getting direct messages, but they were getting added to random teams of strangers. As a result, people were asking Keybase for a way to proactively report and block people, both on Twitter and through GitHub issues. Meanwhile, there was, throughout all of this, no response from Keybase when people contacted them directly.
In fact, someone had already done some sleuthing on this issue and written up a fantastic blog post, with meticulous documentation, on the teams issue. He had contacted Max and Chris directly and gotten this in response:
The reply I received from Chris Coyne on November 13th (Highlighting by me):
Hi Dave - thanks for reaching out in a responsible way with what you see as a security issue.
We currently see team additions as analogous to email thread additions or phone messaging — lowering the friction makes for easier/healthier group forming, and if you’re not interested you can jump out. We’re actually rolling out shortly some newer/better tools around dealing with this, so it will be very obvious to you that you can choose not to be in the team upon being added….and it will therefore feel a bit more like an invitation.
We’re constantly revisiting this and we might also add an advanced setting that lets users specify rules around themselves getting invited/added to convos.
It’s all well and good for Keybase to suggest that lowering friction creates more rainbows and world harmony. In the meantime, the women I know on Keybase are having to do the very manual process of blocking people, leaving group chats they didn’t want to be part of, and changing their profile pictures so it’s not obvious that they’re women.
What to make all of this?
Let’s put aside the issue that neither of the founders has ever had the experience of being a woman online and understand the impact of this kind of behavior directed at them. And that they either naively, or deliberately, do not see this as a problem (similar to Zuck’s constant and extremely naive argument that a default-open world is always a good thing). It’s an important issue, and one that deserves a post of its own. Because, as we already know, Silicon Valley (and every other industry in America) is terrible at making products for women.
Let’s take a look instead at the root of the business problem. From a Normcore perspective, it’s alarmingly easy to understand what’s going on here. Keybase, once they were funded by A16Z, was given a mandate of hypergrowth and gaining users as fast as possible. Now that it’s funded by Stellar, it’s obligated to get more users on the Lumen cryptocurrency platform. Where A16Z left off, Stellar is now at the reins. Stellar’s perspective is simple: The more people that use their cryptocurrency, the more credibility there is, the more it’ll rise in the cryptocurrency rankings to be as legitimate as Bitcoin (which is the cryptocurrency probably everyone knows). Stellar doesn’t care whether these people are harassing anyone. All it cares about is activity on the Keybase platform, and, eventually, on Coinbase. What’s a better way to have people find out about your platform than to offer what people interpret as free money through airdrops?
Keybase, as of September, had 300,000 active users. Its Airdrop page now says it’s up to almost 300,000 registered for this current Airdrop, making the active at least userbase 600k. That’s an increase of 200% over the course of a couple months. That’s one way to cash in on the Stellar Foundation money and ensure more people are talking about and using Lumens. It’s also a really fast way to lose control of your userbase.
Second, from Keybase’s perspective, the company wants to make it easy to talk to people, regardless of who those people are, because that also draws people to the platform. Enabling blocks and checks enables friction, which they don’t want. They said as much in the reply to the incident report. In this way, even though Keybase is a platform that bills itself as a privacy play, it’s absolutely no different than Facebook or Twitter, which also struggle with the balance between allowing harassment and allowing their userbase to grow.
The founders of Keybase have been focused on getting the technical parts of encryption, cryptowallets, and the like right. But they’ve missed the bigger point: every technology platform is eventually ruled by social rules just as much or even more than by code. Eventually, once they’re large enough, platforms become more than just pipes, and the creators of those platforms need to decide whether to take responsibility for the content on them. As every Normcore reader knows by now (rolling their eyes, waiting for me to say it),good things don’t scale. As soon as you can’t or are unwilling to police a growing social platform, you can’t enforce the quality.
Being at the intersection of economic incentives and societal internet problems is a very bad time and very difficult to reconcile. It’s no wonder that, instead of addressing this, Keybase is focusing on airdrops.
In the meantime, the amount of abuse on the platform continues to grow, with an entire thread full of people angry about spam and harassment and now leaving the platform.
In the long-term, Keybase founders will have to decide what’s more important to them: a heavily monetized and growing, but anonymous base of cryptocurrency users (maybe including some of the same kind of bad actors that eventually brought down Mt. Gox), or a maybe less profitable but privacy-forward chat that actually is a healthy platform for all users.
It seems like, for now, they’ve chosen door A.
Art: Rosalyn Drexler, Marilyn Pursued By Death (1967)
What I’m reading lately
Teaching about cryptocurrency in North Korea? You hate to see it
“Please quote this tweet with something everyone in your field knows”
Zuck interviews economist Tyler Cowen and Stripe’s Patrick Collison
About the Newsletter
This newsletter is about issues in tech that I’m not seeing covered in the media or blogs and want to read about. It goes out once a week to free subscribers, and once more to paid subscribers. If you like it, forward it to friends!
Select previous free Normcore editions:
What’s up with Russia’s Internet· I spent $1 billion and all I got was this Rubik’s cube· Die Gedanken sind frei · Neural nets are just people· Le tweet, c’est moi· The curse of being big on the internet· How do you like THAT, Elon Musk?·Do we need tech management books? ·Two Python Paths
Select previous paid Normcore editions:
Imgur is bad now · Eric Schmidt and the great revolving door· No photos please · Deep thoughts of Cal Newport
About the Author:
I’m a data scientist in Philadelphia. Most of my free time is spent wrangling a preschooler and an infant, reading, and writing bad tweets. I also have longer opinions on things. Find out more here or follow me on Twitter.