6 ms·
There were multiple questions/comments below about this, so I felt I should clarify one detail about the keybase client's trust of the server. When the keybase
by malgorithms 13y ago
There were multiple questions/comments below about this, so I felt I should clarify one detail about the keybase client's trust of the server. When the keybase client requests maria's key from the keybase server, it does not simply trust the public key because it trusts the server (or uses https - huh?).
Rather, the server replies with links to tweets, gists, etc. -- maria's public identity proofs. The keybase client does not trust that these are honest, so it scrapes them directly and makes sure they were signed by the same public key that the server provided. In other words, the server could reply with a different maria, and simply lie, but not with the real maria's github or twitter account.
The server could also lie by omission, leaving out an identity. But it cannot invent ones that do not exist, without the client knowing.
Again, the premise here is that maria is the sum of her online identities.
The website itself is of course a different story. When you look up maria on keybase's website, you are trusting that keybase.io did not lie about her github account. Fortunately you can confirm by following the link to her gist, where she announced her keybase username and posted her key fingerprint.
- theboss 13y agoI don't see why you don't just get the key once, allow you to verify it, and store it locally. It seems pointless to make all these extra requests to you. There's a reason that gpg does this..... Maria's twitter being hacked, Maria's github being hacked, Maria's Keystore being hacked....a lot can go wrong. There are still weaknesses like, you lie about a github and link to your own github, and lie about the public key. And...many others.
- malgorithms 13y agoyes, it does do this; once you're satisfied with maria's identity, that she's the person you want, you sign a statement to that effect, which you can store just locally or post back to the server. (or of course you can just sign her key in GPG!) The latter - posting back to the server - is for portability reasons. A keybase user will likely use keybase on multiple machines.
- midas007 13y agoThe point of SKS is signing keys each other's keys and being distributed. This just fragments into a SPoF service without making the existing ones better.
- bulte-rs 13y agoPerhaps I don't understand the whole keyserver concept... But how is a keyserver not a centralised "IdP" like construct?
- kyrias 13y agoPGP keyservers talk to each other, if you send your key to GnuPG keyserver it'll end up on MIT's keyserver pretty soon.
- midas007 13y agoThanks. The WoT depends on not trusting the keyservers, but trusting that humans on the other end know whom to trust and get them to countersign each other's keys. SSL CAs:GnuPG (GPG/PGP) -> Subversion:Git
- midas007 13y agoI don't see how this is any better than a keyserver and just asking confirming their GPG fingerprint by some other means. Not knowing someone and guessing that their fingerprint is right from some third party is very sketchy because it doesn't use a trustworthy, authoritative source (the other person). Also, WoT works best when people meet other people they trust in person and sign each other's keys as the GNU/Linux community encourages. https://www.kernel.org/signature.html https://www.kernel.org/signature.html Then it's possible to get other people's keys elsewhere on the planet and know they're probably good given they're signed by someone you trust.
- fiatjaf 13y agoWhat the GNU/Linux community encourages is clearly not being useful for making lots of people use PGP.
- midas007 13y agoThen let's make apps that explain i) how it works with pictures and ii) exchange keys more easily: say share key ids with barcodes. GPG mail plugins that popup a barcode that someone else can scan with their laptop's webcam or some mobile app. GPG mail plugins should also have a search toolbar that can quickly get a key so it can be verified. Mobile platforms must support GPG natively, many only support S/MIME.