Veil and Keybase compared

What Keybase did#

Keybase opened in 2014. You made a key, then posted a signed statement on each of your accounts: a tweet, a GitHub gist, a Reddit post, a file or a DNS record on your own domain. Anyone could follow those proofs and see that the key and the accounts belonged to one person. Keybase kept every user’s chain of signatures in a Merkle tree and wrote the root of that tree into Bitcoin transactions, so a quiet change to someone’s history could be caught from outside.

On top of the proofs it built an encrypted chat, shared folders and teams. Zoom bought the company in May 2020 and its people went on to work on Zoom’s encryption. Keybase still runs and still gets maintenance releases, but very little new has shipped since then.

The same idea, built again#

Veil is the public directory of cryptographic identities. A card ties the keys of a person or an organisation to the accounts people know them by, such as Discord, GitHub, email, a domain or the Fediverse. You look someone up by an account you already know and get their key, checked in your own browser. And because the keys stay on the owner’s devices, someone who steals one of those accounts still can’t sign as them.

Keybase did this first, and Veil owes it the idea. The differences are in who checks the claims, how they are made public and where Veil started.

Where Veil differs#

• Every change to a card is an entry in a public log. Independent witnesses of the Witness Network, among them Google’s transparency team, Mullvad and Geomys, cosign the log’s checkpoints, and a checkpoint counts only with at least two of their signatures. If Veil showed you one card and showed someone else another, both histories could not match what the witnesses signed.
• The check runs in the reader’s browser. The page fetches the card, its entry in the log, the proof that the entry is in the tree and the cosigned checkpoint, and verifies them on your machine. The server’s answer counts for nothing until those checks pass. The veil command line runs the same checks in a terminal.
• Discord came first. It is Veil’s first use case, so a Discord account is a full link, proven through Discord’s own sign-in, and the Veil app on Discord shows anyone’s card from a right click. Other platforms work the same way, and more are added one at a time.
• Organisations have cards of their own, with owners and members. A member shows the organisation’s logo beside their name only when both sides have signed the membership.
• A website can offer Sign in with Veil, which is OpenID Connect with the card as the account. The browser’s device key signs the consent, so there is no password to steal.

What Keybase has that Veil doesn’t#

Keybase has encrypted file storage and a long history of mobile apps. Veil has a chat at chat.veil.pub where your user is your card, but it has no shared folders and it doesn’t encrypt files for you. If your team keeps its files in Keybase today, Veil doesn’t replace that.

Keybase also took proofs from Twitter, Reddit and Hacker News. Today Veil links Discord, GitHub, email, domains and Fediverse accounts.

Bringing a Keybase identity over#

There is nothing to import, because a Keybase proof says nothing about a Veil card. Your keys can come with you, though. If you used a PGP key on Keybase, put its public half on your card as a public key from elsewhere. You sign a short challenge with the private key on your own computer, and the card then shows that key to everyone, checked in their browser. Veil never asks for the private key. Then link your accounts again, each with its own proof.