81–90 of 121 posts
Here are some invites if you are interested. (added more, replaced some used ones) 16 used, here are more https://keybase.io/inv/b24a826ad7 https://keybase.io/inv/6875c4bf5a
https://keybase.io/inv/16bbae7280
https://keybase.io/inv/ca4549544a
https://keybase.io/inv/666215bb91
https://keybase.io/inv/417ae3ff89># Push an encrypted copy of your new secret key to the Keybase.io server? [Y/n] Y What's the purpose of this? What attack vectors does it expose?
You can use it to do actions on the Keybase site by typing in your decryption password. Attack vectors: Keybase site code gets replaced with something malicious, now they have your key password and decrypted private key. You can also do everything on the command line without trusting Keybase's server or their frontend JS.
In some ways that's worse than actively trojaning their JavaScript since there's no possible way for the target to know that's happened whereas the fronted at least has the low but non-zero chance of someone noticing the malicious code.
If anyone wants in, here are 5 invite links. [Edit: all used up.] Each works for only one signup, so hurry up :-) By the way, most users get around 20 free invites shortly after signing up. If one of the links above opened your account, why not share five of your own invites afterwards?
Here are some invites if you are interested. (added more, replaced some used ones) 16 used, here are more https://keybase.io/inv/b24a826ad7 https://keybase.io/inv/6875c4bf5a
Earlier quoted context omitted.
>Keybase has a pretty good command line tool Another example of the walled garden. You need their tool, whereas you can just use gpg with every other keyserver.
Sure. It would be great if they supported both. The suggestion is to use their tooling because it provides a lot of added value, but yes, it would be great if they also provided a standard "dumb" PGP/GPG keyserver, too. Maybe consider contributing to the effort? Quick searched turned up several issues tracking the question: https://github.com/keybase/keybase-issues/issues/327 https://github.com/keybase/keybase-issues…
Here are some invites if you are interested. (added more, replaced some used ones) 16 used, here are more https://keybase.io/inv/b24a826ad7 https://keybase.io/inv/6875c4bf5a
https://keybase.io/inv/943528e525
https://keybase.io/inv/fa145b0e59
https://keybase.io/inv/3e259244ad
https://keybase.io/inv/cfddcccc32https://keybase.io/inv/23d5ce3afc
https://keybase.io/inv/bb28df44d6
https://keybase.io/inv/bb9c4fffa8
https://keybase.io/inv/471c1f67b7
https://keybase.io/inv/44968be986
https://keybase.io/inv/cd6c91d01e
https://keybase.io/inv/cdc45eb48f
https://keybase.io/inv/41d268d0d6
I also have a couple of keybase.io invitations: https://keybase.io/inv/23d5ce3afc https://keybase.io/inv/bb28df44d6 https://keybase.io/inv/bb9c4fffa8 https://keybase.io/inv/471c1f67b7 https://keybase.io/inv/44968be986 https://keybase.io/inv/cd6c91d01e https://keybase.io/inv/cdc45eb48f https://keybase.io/inv/41d268d0d6 https://keybase.io/inv/b74615140f https://keybase.io/inv/d90ac04ed3
Earlier quoted context omitted.
How much of a pain is it? You just click on the fingerprint on their page, no? https://keybase.io/stavros
OK, I clicked. Where is your email address? Was that stawros or stavros? Do I really need to copy the key or .asc address, wget it and import? How do I know if that's your latest key? Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? THERE MUST BE AN EASIER WAY! Ehh screw that. I'll write it in plaintext.
Revocations are a big problem.
As browser PKIs have demonstrated, revocation lists are basically insane and absolutely Do Not Work at scale when keys are able to live for years.
The endgame with browsers was that the cert revocation lists basically aren't checked. Hooray.
More fundamentally, revocation (even if it was scalable) is fail-unsafe. If someone can block your connections to revocation info sources, they can get you to perform unsafe operations. It's not a stretch to say that this is an absurd problem when we're trying to roll out secure cryptosystems: a network DoS should not crack open my security.
This is something TUF -- http://theupdateframework.com/ -- tackles with their timestamped re-assertions. It limits the amount of time that you can fail-unsafe by after seeing a revocation... to a tunable parameter, perhaps days or even hours, instead of years. At the same time, you get to keep your long-lived keys (you don't have to constantly update everyone on new keys).
We should learn some tricks from TUF for our personal comms PKIs. It would solve a lot of problems.