keybase / keybase/keybase-issues

Those without a keybase user account should still be able to use the cli to encrypt messages for those who do

Open
#958 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

The creation of this issue was triggered by this conversation: https://twitter.com/bepsays/status/500330631931625472

Is there any reason why a non-keybase user couldn't grab the `keybase` cli and use it to encrypt a message for another user that does have a keybase account?

The error caused when trying this seems like it could be avoided, i.e. it isn't actually critical to for both users to have a keybase account, but the cli currently assumes it and fails if the encryptor doesn't.

Here's how to repro:

Assumping you already have the following installed:

```
$ keybase version
keybase (keybase.io CLI) v0.4.15
- node.js v0.10.28
- gpg (GnuPG/MacGPG2) 2.0.22
- libgcrypt 1.5.3
Identifies as: 'keybase.io node.js client v0.4.15 darwin'
```

1) Move your `.keybase*` directories out of the way:

```
mv ~/.keybase ~/.keybasebak
$ mv ~/.keybase-installer/ ~/.keybase-installerbak
```

2) Try to encrypt a message as usual:

```
$ keybase encrypt -m"Top secret" chris
```

3) Note the exception as follows:

```
warn: No config file found; tried '/Users/cbeams/.keybase/config.json'

/usr/local/lib/node_modules/keybase/lib/env.js:396
return (u2 != null) && (u2.toLowerCase() === this.get_username().toLowerCas
^
TypeError: Cannot call method 'toLowerCase' of null
at Env.is_me (/usr/local/lib/node_modules/keybase/lib/env.js:396:72)
at iced.Deferrals.parent (/usr/local/lib/node_modules/keybase/lib/command/encrypt.js:166:21)
at Command.exports.Command.Command.run (/usr/local/lib/node_modules/keybase/lib/command/encrypt.js:210:15)
at /usr/local/lib/node_modules/keybase/lib/command/all.js:271:23
at /usr/local/lib/node_modules/keybase/lib/command/all.js:280:13
at Deferrals.exports.Deferrals.Deferrals._call (/usr/local/lib/node_modules/keybase/node_modules/iced-runtime/lib/runtime.js:86:16)
at /usr/local/lib/node_modules/keybase/node_modules/iced-runtime/lib/runtime.js:98:26
at exports.trampoline.trampoline (/usr/local/lib/node_modules/keybase/node_modules/iced-runtime/lib/runtime.js:64:14)
at Deferrals.exports.Deferrals.Deferrals._fulfill (/usr/local/lib/node_modules/keybase/node_modules/iced-runtime/lib/runtime.js:96:16)
at ret (/usr/local/lib/node_modules/keybase/node_modules/iced-runtime/lib/runtime.js:29:18)
```

Expected behavior would be that the cli doesn't require the encryptor to have a keybase account, and just proceeds as per usual.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure with the documented keybase encrypt command after moving the .keybase directories. Start in lib/env.js at Env.is_me and inspect its call from lib/command/encrypt.js. Done means a user without a Keybase account can encrypt a message for an existing user without the null-method exception.

Written by the indexing model from the issue text.

Assessment

Tech stack
node.js
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.