21–30 of 51 posts
If you claim this airdrop, best practice would be to save the key, and then first rotate your github keys before claiming. In this way any potential security risk is averted.
Yeah but if you use the same key for server management, then you may be in a bad situation :(
How has github _not_ shut this down? I'm not giving away any credentials for anything.
How has github _not_ shut this down? I'm not giving away any credentials for anything.
we do not allow standard PGP signatures on the consensus layer.
This is done for simplicity and safety.
This means that a regular call to
$ gpg --sign will not work for handshake
airdrop proofs.
As far as SSH keys go, people typically do
not sign arbitrary messages with them.
Because of this, we require a special tool
to do both the signing and merkle proof creation.
The right solution: Give me a random block of text, I'll sign it using my private RSA/DSA key and you can verify that I am the owner of the public key, send me the money, and everybody is happy.
Alleged simplicity: Two hours I'm trying to redeem the airdrop without giving away the private key and the passphrase (hint, it's not implemented, despite the documentation somewhat references it here: https://github.com/handshake-org/hs-airdrop#fallback-for-hsm... ).
Alleged safety: after installing dozens of NPM packages and code from whoever who, and running an algorithm that we don't know (even the developers) if it's reversible or not.
I see horrible consequences: https://github.com/handshake-org/hs-airdrop/issues/31
User has key safely inside HSM, gets the key out to get free money that A16Z is supposedly giving.
Reminds me the "Elon Musk gives Bitcoin on Twitter, just send YOUR PASSWORD"
On the practices overall:
It's unclear what the private key derivation process does and if the developers themselves truly understand it.
If the developers would understand the full security implications, they would not say it's safe to do it on an air-gapped machine.
The process could just multiply by two or base64 encode the private key, it would be near invisible since the whole code and theory is a big soup.
All that, supposedly for privacy benefits, when at the end, you have to give your real identity and ID documents to actually withdraw/exchange the coins.
How has github _not_ shut this down? I'm not giving away any credentials for anything.
You don't have to, it works by signing a message with your PGP or SSH key. All GitHub users' public keys are already available from their API, that's how the airdrop works.
The airdrop tool takes your private key and your passphrase, does some overcomplicated (and unconventional) magic with it and asks you to post the resulting data to the public.
I find it a bit strange: Pro-tip: Learn why the airdrop tool needs to use your private key. So someone will give you 2000 USD if you feed your private SSH key into their software ?
I believe you can have the airdrop tool [0] output the raw bytes that you need to sign with your private key. Still not fool proof but makes it more transparent what you're actually doing with the key. [0] https://github.com/handshake-org/hs-airdrop
As I understand it developers have to submit a government ID to withdraw their tokens. https://help.namebase.io/article/usgrydy7da-kyc-restrictions This is a bit concerning, and it practically negates the privacy claims of the airdrop, unless people only use the tokens to bid on Handshake names. Could you share more details about the documents you're requesting? Which company handles the personal data?
If you claim this airdrop, best practice would be to save the key, and then first rotate your github keys before claiming. In this way any potential security risk is averted.
Earlier quoted context omitted.
I believe you can have the airdrop tool [0] output the raw bytes that you need to sign with your private key. Still not fool proof but makes it more transparent what you're actually doing with the key. [0] https://github.com/handshake-org/hs-airdrop
Yeah that's how the airdrop tool works and the instructions use that tool too (the first step in the instructions just shows how to install the tool).
Several hours, flipping the code in many ways, such option doesn't seem to exist (and for sure isn't documented)
How do I claim the airdrop with keybase? If I have a HN/keybase account and a github account, can I claim the airdrop twice?