Install-less, hosted-private-key-less Github, Twitter and Web site verifications are now live on keybase.io. Enjoy!
Refusing to verify myself: I am liz on Keybase.io
111–114 of 114 posts
Re: Refusing to verify myself: I am liz on Keybase.io
#112In reality, the biggest risk for routine comsec with pgp is that no one uses it because it's difficult, but the very specific app of code signing is something where keys need a lot of protection IMO. (I am mostly fine with START TLS for email security 99.99% of the time) The thing which terrifies me is that the npm keybase app asks for my GPG key directly in the same window, and it's impossible for me to (easily) tel…
There's one instance in which we prompt for your PGP password directly, since gpg doesn't give us command line access to the needed feature: that's adding the username to your public key if it's not already there. Aside from that, we never need your PGP password and just rely on gpg to prompt for it when needed. If you're seeing other prompts, it could be bug, please let us know!
I'm three days late, but I'm interested in Keybase and wondering if I could bum an invite from you.
Re: Refusing to verify myself: I am liz on Keybase.io
#113I like the idea of Keybase.io, but I would prefer to use it in a way in which I don't have to trust them at all. As it stands, you need to install their command-line tool and have it directly manage your GPG keychain. For that, I'd prefer to have a platform-neutral tool that's been independently audited and managed by my OS's package manager rather than their keybase-installer tool which seems to want to update very…
While we like being #1 on Hacker News, bad (good?!) timing is what earned us this spot. It will be the case very soon that you can push your key to Keybase and prove all your identities, without ever installing the client the OP dislikes. Technically, you can already, we just need to put together very explicit instructions and documentation that's different for each kind of proof. By ugly necessity, what it takes to…
This feature is now live on keybase.io. You can prove Twitter, GitHub or Web site identities without posting a secret key or installing our installer. We give you a (rather long) pipeline to run at your shell.
Re: Refusing to verify myself: I am liz on Keybase.io
#114Earlier quoted context omitted.
Then again, why not use namecoin ? They (we ?) have a spec with what format your records should look like: https://wiki.namecoin.info/index.php?title=Identity Basically, there's a whole id/ namespace where you register your personal information, and there's a d/ namespace where you register domain names (akin to DNS). Onename is the same except they use i/ (they haven't even tried to discuss it and basically did it a…
>You have asked Firefox to connect securely to wiki.namecoin.info, but we can't confirm that your connection is secure.
Looks like they didn't pay protection money to a CA. Huh.