Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Setup Keybase.io, GPG and Git to sign commits on GitHub

github.com

Post reply on HN
Print view View original

41–50 of 121 posts

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#41

Post by daveguy »

akerro wrote: post #2

Is keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?

Edit: I think I found it -- generally referred to as keyservers? Here is a stackexchange post:

http://superuser.com/questions/227991/where-to-upload-pgp-pu...

Can someone please give examples of key-exchange services or server applications? I am getting a bunch of Microsoft exchange results when I try to google it.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#43

Post by akerro »

StavrosK wrote: post #40
davexunit wrote: post #37

Earlier quoted context omitted.

The problem is that AFAIK they don't tell their users that anywhere, and I often encounter people that only have their key on Keybase and it's a real pain to import their key.

How much of a pain is it? You just click on the fingerprint on their page, no? https://keybase.io/stavros

OK, I clicked. Where is your email address? Was that stawros or stavros? Do I really need to copy the key or .asc address, wget it and import? How do I know if that's your latest key? Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? THERE MUST BE AN EASIER WAY!

Ehh screw that. I'll write it in plaintext.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#44

Post by akerro »

snassar wrote: post #28
akerro wrote: post #2

Is keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?

I don't really get what keybase.io is supposed to solve, but it doesn't get in the way of importing keys into Enigmail. If you are in Enigmail's Keymanager you can import from a URL when the content is well-formatted. Examples that work: https://keybase.io/snassar/key.asc https://pgp.samirnassar.com http://keys.gnupg.net/pks/lookup?op=get&search=0x69A75542488... It would be nice if Keybase made the URL more easily "g…

Keybase was created by NSA to make pgp/gpg harder...

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#45

Post by akerro »

lil1729 wrote: post #20
matt4077 wrote: post #6

Note that you don't need keybase.io to sign your commits: https://help.github.com/articles/signing-commits-using-gpg/

Thanks for saying this. Or in other words, there are two steps: 1. Make git aware of your signing key git config user.signingkey "..." 2. Sign the commit git commit -S ... That's it.

You can also configure git in global config or per-repo to sign commit automatically:

https://harryrschwartz.com/2014/11/01/automatically-signing-...

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#46

Post by snassar »

daveguy wrote: post #41
akerro wrote: post #2

Is keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?

Edit: I think I found it -- generally referred to as keyservers? Here is a stackexchange post: http://superuser.com/questions/227991/where-to-upload-pgp-pu... Can someone please give examples of key-exchange services or server applications? I am getting a bunch of Microsoft exchange results when I try to google it.

The go-to keyserver software is SKS https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Home and the network of SKS Keyservers can be found at: https://sks-keyservers.net/

Things to know about keyservers such as SKS: There is no way to remove keys or a way to really delete information. Uploading to know server will propagate that information to all SKS servers in the network over time.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#47

Post by FungalRaincloud »

sleepychu wrote: post #42

># Push an encrypted copy of your new secret key to the Keybase.io server? [Y/n] Y What's the purpose of this? What attack vectors does it expose?

Keybase desires to act as a keyserver and public identity record, keeping your aggregated identity, and a backup of your public and private key pair. The latter is (read: should be) encrypted and only accessible to you. They make that optional, though, and will happily keep track of only your public key. It is absolutely optional, and it exposes you in one critical way: You have to take Keybase's word that they cannot (and will not develop the ability to) access your private key, even though it's on their servers.

I don't use that feature, because I can't see an advantage to it. I can keep a paper copy of my private key in a safety deposit box, if I'm worried about having a secured backup of it that's out of my hands.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#48

Post by benmanns »

sleepychu wrote: post #42

># Push an encrypted copy of your new secret key to the Keybase.io server? [Y/n] Y What's the purpose of this? What attack vectors does it expose?

You can use it to do actions on the Keybase site by typing in your decryption password. Attack vectors: Keybase site code gets replaced with something malicious, now they have your key password and decrypted private key.

You can also do everything on the command line without trusting Keybase's server or their frontend JS.

Re: Setup Keybase.io, GPG and Git to sign commits on GitHub

#50

Post by libeclipse »

fphilipe wrote: post #49

I'm not sure keybase does this by default, but make sure to upload your key to a keyserver such as MIT's ( https://pgp.mit.edu ). Otherwise, git will complain that the signature is invalid when doing `git log --show-signature`.

Github doesn't complain for me, so I can only assume that it does this itself. What I did was grab my key from keybase and inserted that into my local keyring, then uploaded that to my github.
Post reply on HN