3 ms·
Regarding 1): Could someone with more expertise explain how Keybase protects against MitM attacks please? Does it simply rely on the difficulty of compromising
by rmhsilva 11y ago
Regarding 1):
Could someone with more expertise explain how Keybase protects against MitM attacks please? Does it simply rely on the difficulty of compromising the SSL certs of multiple assertions (twitter.com, github.com, etc)?
As far as I can tell, if someone was able to 'pretend' to be Twitter, ie, MitM an HTTPS connection to twitter.com, they could 'pretend' to be someone who only has their Keybase info on Twitter. Of course, putting your key data in more places makes it harder to appear as you.
- a-priori 11y ago1) MitM on TLS requires being able to issue trusted certificates for any domain. That means you either own an already trusted certificate (which basically means you're a state-level actor), or you can install a certificate on the victim's device (which means you have physical access/ownership of the device). It's also detectable through certificate pinning. 2) In Keybase, if you 'track' someone, you sign the assertions they've made as of today. So in the future you (or anyone else -- tracking is public) can detect if those assertions have changed since you first started tracking them.