Keybase.io
tbray.org
Keybase.io
1–10 of 117 posts
Re: Keybase.io
#2I'm interested in chat client capacity implemented on top of something like keybase.io. Anyone?
Re: Keybase.io
#3What I think that they get very right is tying keys to social identity, as these networks function much better as a web of trust than the original PGP version. But I don't know why I can't shake the feeling that this is not a trustworthy service.
Re: Keybase.io
#4My thoughts are that with the implementation of data retention laws in Australia the ultra paranoid arena of PGP is becoming of greater relevance to the average citizen and so a simple, easily implemented, non-centralised, publicly identifiable crypto for everyday comms may become not only viable, but sought after - http://blog.lrdesign.com/2014/03/thoughts-on-keybase-io/
Re: Keybase.io
#5What I think that they get very right is tying keys to social identity, as these networks function much better as a web of trust than the original PGP version. But I don't know why I can't shake the feeling that this is not a trustworthy service.
One really nice aspect of keybase is that it can be used at a number of different levels that suit one's own flavor of paranoia. You can use it as a key repository, just grabbing people’s keys and using your own PGP/GnuPG apparatus for signing. Or you can use their (much more pleasant) CLI and see their social identity tracking data. Or you can use their web UI just for client-side encryption/verification (also without uploading your key anywhere). Finally, the bold can upload their keys and use the web UI for the whole shebang, including decrypting/signing.
I think paranoia is warranted in this day and age, and I think one of the best outlets for paranoia is for people to try and educate themselves about privacy technology. Keybase is a great opportunity for that, since all of the most sensitive operations happen client-side via open source software.
Re: Keybase.io
#6I'm interested in chat client capacity implemented on top of something like keybase.io. Anyone?
I remember reading somewhere that PGP is not suited for realtime web chats. Can't explain precisely why or cite sources, though.
Re: Keybase.io
#7I have four^Wtwo invites available, if anyone's interested. Message me via email. FIFO and all that.
Edit: invites are gone. Try emailing the project leaders for some.
Re: Keybase.io
#8I'm interested in chat client capacity implemented on top of something like keybase.io. Anyone?
I remember reading somewhere that PGP is not suited for realtime web chats. Can't explain precisely why or cite sources, though.
It's because asymmetric cryptography is very inefficient, so most protocols just use asymmetric public/private keys to send a symmetric key (AES, etc) to the recipient, so further communications can happen over the much more efficient symmetric keys.
Re: Keybase.io
#9Earlier quoted context omitted.
I remember reading somewhere that PGP is not suited for realtime web chats. Can't explain precisely why or cite sources, though.
It's because asymmetric cryptography is very inefficient, so most protocols just use asymmetric public/private keys to send a symmetric key (AES, etc) to the recipient, so further communications can happen over the much more efficient symmetric keys.
That and PGP, AFAIK, also doesn't really do perfect forward secrecy. If you get the private key, you can decrypt all stored messages.
That said, you provide the answer: use PGP's asymmetric encryption to establish a session key, then use that to communicate.
Re: Keybase.io
#106 first-come, first served invitations.
I love the idea of Keybase and wish more people were using it. While it's not a replacement for keysigning parties, it's a nice probabilistic model for casual security.