[deleted]
Keybase.io
111–120 of 125 posts
Re: Keybase.io
#112Hi everyone, Chris here, I've been working with Max on Keybase. I can't help but feel this ended up scooped a bit early. (Crap!) Not a surprise, because HN is quick. The alpha site's changing every day, and we're working on the documentation now. I don't use the term "alpha" loosely. There will be extensive security details published, explaining every aspect of the identity proof system, client sessions, etc. They wi…
Hi Chris - it looks like a neat idea. One question: Is this another global namespace, or do you plan to support pet names?
Re: Keybase.io
#113[deleted]
Re: Keybase.io
#114https://sks-keyservers.net/ Advantage: it's distributed
I love sks as much as the next GPG user, but this is about as clean as I'd expect from a user friendly keyserver. Sounds like a datamining goldmine too, but what do you expect from OkCupid founders. btw had to do it. https://i.imgflip.com/6w8mc.jpg
i'm surprised by the number of comments which attempt to mock SKS because "the UI is not nice looking" "the url sucks to remember".
I'm like, wow, if that's the only issue, that's great lol. Sounds pretty easy to fix ;-)
Re: Keybase.io
#115Earlier quoted context omitted.
I'm not an authority on hushmail, but it seems like they do crypto on the server, and the server is just trusted to throw away the keys and plaintext? In the keybase Web client, all crypto happens on the browser. The server knows no keys or data in plaintext. Of course, you'd have to audit the front-end JS code to believe that claim. But our intention is that the only way to compromise the Web-based tools would be to…
Then the only difference between hushmail and your model is exactly what the FBI will get a subpoena to have you type into your server to subvert your users. The models are equivalently insecure. Incidentally, you can't simply audit the "front-end Javascript"; you have to evaluate everything that influences the Javascript runtime (the DOM, stylesheets, cached resources, &c) every time the page loads . Browsers aren't…
If this functionality were provided by e.g. a signed extension (so the code can't be changed without the user being told: I think browsers can do this?), then you would worry mostly about how well that extension was sandboxed away from other extensions and various websites, right?
Re: Keybase.io
#116Earlier quoted context omitted.
Hi Chris, a few comments: 1. I like the site design, the story flow on the front page does a great job of explaining what keybase is. 2. I see (from the abovementioned story flow) that keys can be verified by reviewing signed tweets/gists. Is this functionality extendable to arbitrary links; i.e. verifying keys against personal blogs, Tumblr, WordPress or does the third-party site need to implement a recognized API?…
Good question! There will be no such thing as a general check, because -- for any identity -- the client software has to perform a check that a human would agree means something. For example, what does it mean that you own a certain blog? How would a person confirm it? Well, at first glance it might mean that you have the power to post a message there. But someone else could do that it in a comment, and so that would…
Please remember that some blogs (and possibly other types of sites, such as Tumblrs) can be owned and managed by multiple people.
Re: Keybase.io
#117Earlier quoted context omitted.
The idea here isn't that you use keybase to find out Maria's twitter, github or gmail identities - it's the opposite. The idea is that you already know who Maria is on one or more of those services, so the fact that the account you know is Maria's at github has posted a signed message from that public key is supposed to testify to you that that is really your Maria's public key. You could of course manually review an…
s/could/should/?
Only if you don't trust your copy of the keybase client (as opposed to the server, which you should not need to trust).
Re: Keybase.io
#118Just want to say cool art work on the landing page
Done by the extra talented Caroline Hadilaksono! http://www.hadilaksono.com/
For me it increased the perceived trustworthiness of the website 10 times. I've seen illustrations drawn in similar style in Scientfic Amercian and subconsciously carried over the trust I have for SA to this site.
Re: Keybase.io
#119Earlier quoted context omitted.
I don't see how this is any better than a keyserver and just asking confirming their GPG fingerprint by some other means. Not knowing someone and guessing that their fingerprint is right from some third party is very sketchy because it doesn't use a trustworthy, authoritative source (the other person). Also, WoT works best when people meet other people they trust in person and sign each other's keys as the GNU/Linux…
What the GNU/Linux community encourages is clearly not being useful for making lots of people use PGP.
Then let's make apps that explain i) how it works with pictures and ii) exchange keys more easily: say share key ids with barcodes.
GPG mail plugins that popup a barcode that someone else can scan with their laptop's webcam or some mobile app.
GPG mail plugins should also have a search toolbar that can quickly get a key so it can be verified.
Mobile platforms must support GPG natively, many only support S/MIME.
Re: Keybase.io
#120Earlier quoted context omitted.
yes, it does do this; once you're satisfied with maria's identity, that she's the person you want, you sign a statement to that effect, which you can store just locally or post back to the server. (or of course you can just sign her key in GPG!) The latter - posting back to the server - is for portability reasons. A keybase user will likely use keybase on multiple machines.
The point of SKS is signing keys each other's keys and being distributed. This just fragments into a SPoF service without making the existing ones better.
Perhaps I don't understand the whole keyserver concept... But how is a keyserver not a centralised "IdP" like construct?