121–125 of 125 posts
Earlier quoted context omitted.
The point of SKS is signing keys each other's keys and being distributed. This just fragments into a SPoF service without making the existing ones better.
Perhaps I don't understand the whole keyserver concept... But how is a keyserver not a centralised "IdP" like construct?
Earlier quoted context omitted.
Well, to follow up, could this be extended to ownership of a domain (via DNS txt record)? Could we use this as a means of authentication of a self-signed certificate for a domain?
Yes to DNS, though we have to be careful here since DNS can be spoofed more easily than github or twitter proofs over https. I was thinking a slightly better way to prove ownership of foo.com would be to post a proof at https://foo.com/_keybase (or something similar). To spoof this, an attacker would have to spoof DNS and also the https certificate. Authenticating a self-signed domain certificate via keybase is a nea…
If this talks to keybase's API over https and any large groups come to rely on this, we've then effectively replaced the decentralized safety of the Web of Trust used for authenticating PGP keys with the PKI that's used in browsers, which is completely and totally fucked. I cannot support a project that doesn't build and strengthen the underlying WoT. Getting https involved for authenticating unknown keys is a huge s…
We're not big fans of browser PKI either, but we're using it as scaffolding that hopefully one day can be torn down. `keybase-installer` needs an initial install over https from npm. We unfortunately saw no way around this. Assuming that install succeeds with integrity, then all future upgrades of the installer and client are verified with PGP keys stored locally on the client. Once the client is installed, it speaks…
Write it in a language that has a packaging system not designed by amateurs.
Earlier quoted context omitted.
Perhaps I don't understand the whole keyserver concept... But how is a keyserver not a centralised "IdP" like construct?
PGP keyservers talk to each other, if you send your key to GnuPG keyserver it'll end up on MIT's keyserver pretty soon.
SSL CAs:GnuPG (GPG/PGP) -> Subversion:Git
I really, really want crypto, specifically, safe and secure-by-default crypto, to become much more usable. Despite this hope, I can't seem to help the fact that the first thing that popped into my head when I read their webpage is "oh, they're wrapping and abstracting important key authentication and critical key trust configuration to make it more user-friendly, and implementing it all in javascript. WHAT COULD POSS…
LOL. http://tobtu.com/decryptocat.php On a serious matter, javascript (eg all browsers) absolutely needs to change to make the web more trustworthy. I agree with some of the Matasano points[0], but these are the minimum, exhaustively complete changes that would improve browser security: i. js that can be cryptographically signed and verified, a trust model and a browser security policy to enforce it. Think ascii armo…