by achernya on 3/31/14, 5:09 PM with 103 comments
by kylec on 3/31/14, 6:04 PM
by rdl on 3/31/14, 6:02 PM
The thing which terrifies me is that the npm keybase app asks for my GPG key directly in the same window, and it's impossible for me to (easily) tell when the password prompt is from my GPG binary (which I pretty much trust) vs. the npm binary.
I'm using keybase now (rdl), mostly because I trust Chris Coyne personally, and because my key is old. I'm creating a new 4096 RSA key soon, and will be a lot more paranoid about protecting it -- it will only ever exist on read/use only smartcards after initial generation on a secure machine. (sadly, openpgp card doesn't support export and replication, so to be durable, I have to generate it externally and load onto a bunch of cards and then delete the external key; I'm not willing to trust my keys to a single smartcard I carry with me.)
Using keybase with gpg agent is maybe a bit safer. I don't really mind being forced to do bad stuff by keybase, due to the risks to them if they're caught, as long as it doesn't expose my keying material. gpg agent plus a hardware smartcard should mostly protect me. The pure-software alternative would be a bunch of text-file messages which I can manually cut and paste and move around between clearly-distinct processes running in separate shells/windows (or machines!).
I've been thinking about something a lot better than openpgp card, though, as a secure end-user key management device, with more than just key protections. Unfortunately that means making custom hardware, and that makes little sense in the volumes PGP achieves; maybe if there are other client-side security credentials like ssh or bitcoin, I'd do it.
by sp332 on 3/31/14, 6:35 PM
APT::Default-Release "precise";
deb http://archive.ubuntu.com/ubuntu saucy main restricted universe
deb-src http://archive.ubuntu.com/ubuntu saucy main restricted universe
Next, run these:
sudo apt-get update
sudo apt-get build-dep -t saucy nodejs
sudo apt-get -b source -t saucy nodejs
dpkg -i nodejs_0.10.15~dfsg1-4_amd64.deb
Package: nodejs
Pin: release n=saucy
Pin-Priority: 1000
by rsync on 3/31/14, 5:33 PM
Surely not...
by shazow on 3/31/14, 5:43 PM
by exelius on 3/31/14, 8:35 PM
I think that's a fair stance to take on early-alpha software.
by eik3_de on 3/31/14, 5:38 PM
by jrochkind1 on 3/31/14, 6:21 PM
* keybase acted honestly
* nobody compromised keybases software when it was doing the verification
* _after_ it did the verification, nobody managed to get keybase to switch out `liz`s key for some other key that wasn't really liz's (either because keybase was compromised, or keybase was untrustworthy... maybe because the government made them be?)
That last one is the kicker for me. If keybase catches on, surely they are going to get government orders to swap our one key for another key at some point.
The traditional web of trust does not require trusting any of those things, or at least not in those simple forms.
On the other hand, yes, there are reasons traditional PGP hasn't caught on, and usability is a big one. But, still, to compromise security for usability... if you go all the way there, you just wind up where we are now, not secure at all, right?
So, okay, is there value in going some of the way there, and getting some improved security but not as much as you could, for a more usable experience? Maybe. The danger is that people will think they are getting a lot more security than they are getting, and that situation can be worse than no security at all.
One thing Snowden taught us is that if you have to trust a third party to be honest... it's not that the people running keybase aren't honest, it's that the government will _compel_ them to be dishonest if it ever matters to them.
by raverbashing on 3/31/14, 5:29 PM
No thanks.
" It doesn't seem particularly safe for me to trust my valuable PGP keys to this system."
I agree
by phelmig on 3/31/14, 9:05 PM
Liz wants to authenticate. Keybase sends her a challenge, which she encrypts using her private key. Keybase uses her public key to verify that liz owns the private key for her public PGP key. Easy peasy.
by riffraff on 3/31/14, 6:40 PM
It seems that I can authenticate, get a few people to track me, than revoke my key and upload a new one. I can also, obviously, recover my password via email.
And at the end of the process, people who were "tracking" me will still be tracking me. I am not sure this is supposed to happen.
by theboss on 3/31/14, 6:39 PM
github report: https://github.com/keybase/keybase-issues/issues/397 blog: http://ejj.io/keybase-io-vulnerability/
by zobzu on 3/31/14, 7:11 PM
And of course, I like that it's distributed and not a business. I don't want people to do business on my identity.
by kbar13 on 3/31/14, 6:58 PM
by mhandley on 3/31/14, 9:00 PM
by cyphunk on 4/1/14, 1:09 PM
No thanks. Not going to install a slew of node packages all from untrusted sources so that i can "claim" my name in some PGP key DB. Key DB's are not the way to go. Name associations are worse. As someone illustrated by pumping snowden@<somedomain> or glengreenwald@<somedomain> keys into gpg servers. The adverse effect of this names system has a heavier weight than the positive.
If people want to improve usability they first should start with authentication. That is, authenticating keys. Second they should develop systems that permit for predictable imperfections in a manner that the user can understand.
by chris123 on 4/1/14, 6:39 AM
by maxtaco on 4/4/14, 3:26 AM
by rhoml on 4/1/14, 1:39 PM
by dreamdu5t on 3/31/14, 7:31 PM
Ultimately you're trusting keybase.io not to mess with the verification process, correct?