4 ms·
I'm not sure about that either. The weakest link seems to be a national security letter to Keybase where they distribute a backdoored version of the FS driver t
by chc4 11y ago
I'm not sure about that either. The weakest link seems to be a national security letter to Keybase where they distribute a backdoored version of the FS driver to Alice, and adds the key of Eve to all messages also encrypted to Bob.
However, Keybase can't just broadcast "Eve on twitter is Bob!" - the client gets that announcement and links you to the tweet that claims it, where you audit the twitter handle, key fingerprint, etc.
- eridius 11y agoAnybody who's worried about being the target of a National Security Letter can just compile from source instead of using a binary distribution.
- rmc 11y agoThis is why the CJEU doesn't view the USA as a safe habour anymore. US laws have broken the internet.
- kedean 11y agoIf the NSA is your adversary model, Keybase isn't for you. If the NSA is your adversary model, NO system involving any central servers is for you, unless they only act as a dumb relay. Since Keybase is also the provider of your proof that another party is who they claim to be, they will always be suspectable to a government adversary. If you want to be NSA-safe, you can't trust any third party companies code, and that just leaves you DOA. tldr; this isn't for the NSA adversary model