13 ms·
Setup Keybase.io, GPG and Git to sign commits on GitHub
- akerro 10y agoIs keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?
- daveguy 10y agoEdit: I think I found it -- generally referred to as keyservers? Here is a stackexchange post: http://superuser.com/questions/227991/where-to-upload-pgp-public-key-are-keyservers-still-surviving http://superuser.com/questions/227991/where-to-upload-pgp-pu... Can someone please give examples of key-exchange services or server applications? I am getting a bunch of Microsoft exchange results when I try to google it.
- snassar 10y agoThe go-to keyserver software is SKS https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Home https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Home and the network of SKS Keyservers can be found at: https://sks-keyservers.net/ https://sks-keyservers.net/ Things to know about keyservers such as SKS: There is no way to remove keys or a way to really delete information. Uploading to know server will propagate that information to all SKS servers in the network over time.
- mapleoin 10y agoAFAIK keybase.io is not meant as a key exchange server. You should publish your keys using an existing exchange server.
- camiller 10y agoExactly! It would be nice if keybase.io had a simple click this button to publish your public key to common key exchange servers. But it isn't that hard to do it manually.
- davexunit 10y agoThe problem is that AFAIK they don't tell their users that anywhere, and I often encounter people that only have their key on Keybase and it's a real pain to import their key.
- StavrosK 10y agoHow much of a pain is it? You just click on the fingerprint on their page, no? https://keybase.io/stavros https://keybase.io/stavros
- akerro 10y agoOK, I clicked. Where is your email address? Was that stawros or stavros? Do I really need to copy the key or .asc address, wget it and import? How do I know if that's your latest key? Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? THERE MUST BE AN EASIER WAY! Ehh screw that. I'll write it in plaintext.
- StavrosK 10y ago> Where is your email address? Was that stawros or stavros? It's right in the key! > Do I really need to copy the key or .asc address, wget it and import? Is this a failure of keybase? You import it as with any other key, "decrypt from clipboard" in your favorite manager, or similar. > How do I know if that's your latest key? I don't know, how do you know that with a keyserver? > Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? Again, same as any other keyserver. > THERE MUST BE AN EASIER WAY! It seems that the frustration is with the PGP client, rather than keybase or the server, though.
- WorldMaker 10y agoKeybase has a pretty good command line tool and commands very similar to ones in the article we are commenting upon can be used to grab the public key of a Keybase user using just their Keybase username. It should probably be easy to presume that if a user gives you their Keybase username they are telling you it's the easiest way to get their most up-to-date key(s) and revocations and that they are actively managing it. (Pretty much the same assumption any time anyone ever suggests to you a specific keyserver over just a fingerprint and keyserver roulette; that's probably the keyserver they actively check/update/revoke and will be the timeliest.)
- snassar 10y agoI don't really get what keybase.io is supposed to solve, but it doesn't get in the way of importing keys into Enigmail. If you are in Enigmail's Keymanager you can import from a URL when the content is well-formatted. Examples that work: https://keybase.io/snassar/key.asc https://keybase.io/snassar/key.asc https://pgp.samirnassar.com https://pgp.samirnassar.com http://keys.gnupg.net/pks/lookup?op=get&search=0x69A75542488B4A1A http://keys.gnupg.net/pks/lookup?op=get&search=0x69A75542488... It would be nice if Keybase made the URL more easily "gettable" instead of hiding it behind 2 clicks.
- akerro 10y agoKeybase was created by NSA to make pgp/gpg harder...
- WorldMaker 10y ago«I don't really get what keybase.io is supposed to solve» Keybase was built to solve the "web of trust" bootstrap problem [1] by leveraging the web of social media profiles a user typically has with simple replicable proofs of social media identity. [1] Arguably the hardest problem in PKI: how do you get user to trust that a public key is for the right person? In the classic PGP/GPG web of trust you do things like "key signing parties" and physical in real life interactions and deciding your threshold for how far you trust the friend of my friend signed this key. In the Keybase model you can see that the key (or family of keys) are tied to a certain combo of Twitter, Facebook, HN, et al accounts/profiles and generally trust that the person with all those accounts is the person you are trying to communicate with.
- snassar 10y agoFair enough, when it comes to coming up with creative ways to solve the web of trust problem. I still do not know what problem keybase.io solves when they allow uploading of private keys.
- WorldMaker 10y agoThat would be the second hardest problem in PKI: key escrow and key management. The answers to the questions most average users have like: What do I do if I lose my machine? If I'm logged in from the library or work or my friend's PC? If I use multiple machines every day? When the "right" answer includes "Print out this long thing, put it in a safe deposit box, and pray you never have to type in this long string of numbers", you immediately lose a lot of potential users; it doesn't quite fit the "Grandparent test" (could your Grandparent use it?). Absolutely there's a trade-off in trusting a 3rd Party key escrow, but there's an immense usability benefit to average users that want something easier to do and "some security" really can be better than "no security", even if a lot of hard-line paranoid wonks have good reason to believe otherwise.
- davexunit 10y agoYes. Keybase is trying to make a walled garden for itself. I got really frustrated by this a couple weeks ago when I needed to get a key from a contractor but it was only on Keybase, which at the time I thought could be used as a GPG keyserver.
- eeeeeeeeeeeee 10y agoJust because something is useless to you does not mean it's useless to everyone else. There are clearly a lot of people using Keybase.
- danieleggert 10y agoYou don't need to have home brew. And most of this can be done a lot simpler: https://gist.github.com/danieleggert/b029d44d4a54b328c0bac65d46ba4c65 https://gist.github.com/danieleggert/b029d44d4a54b328c0bac65...
- sambe 10y agoThe Homebrew steps seem simpler to me, especially if you already use it. Also easy to update - does the suite auto-update? Why don't you like Homebrew?
- ithkuil 10y agoAnybody here got invitation codes for keybase ?
- enzanki_ars 10y agoSend me an email at [my username with the underscore replaced with a period] at the mail service owned by Google.
- 0942v8653 10y agoHi!
- Spydar007 10y agoYep. 28. Email me at root@spydar007.com.
- ryanmaynard 10y agoI think I have 20 or so left. Send a note to hi at myusername [dot] co
- akerro 10y agoYou don't need keybase to sign your commits. Any standard and key-exchange compatible pgp/gpg client will do. By using keybase you're just adding more work for everyone. https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work
- electricEmu 10y agoKeybase makes it really easy to sign commits. By using keybase you get to manage keys and sign quickly. gpg will take hours of reading with its non-intuative cli. You're making less work for yourself. Gpg is the flossing of encryption. It has great efficacy and terrible efficiency.
- csubj 10y agoI think the cooler part of keybase.io is that it provides a platform for authenticating your separate social accounts (reddit,twitter, etc...) along with websites and github. That's pretty neat, and I can't say I've seen something like it before.
- matt4077 10y agoNote that you don't need keybase.io to sign your commits: https://help.github.com/articles/signing-commits-using-gpg/ https://help.github.com/articles/signing-commits-using-gpg/
- lil1729 10y agoThanks for saying this. Or in other words, there are two steps: 1. Make git aware of your signing key git config user.signingkey "..." 2. Sign the commit git commit -S ... That's it.
- akerro 10y agoYou can also configure git in global config or per-repo to sign commit automatically: https://harryrschwartz.com/2014/11/01/automatically-signing-your-git-commits.html https://harryrschwartz.com/2014/11/01/automatically-signing-...
- ex_amazon_sde 10y ago...with the added security benefit of not uploading your private key on Keybase!
- beardog 10y agoHow is publicly sharing your public key a security flaw?
- dijit 10y agoKeybase would prefer to handle your private key too. You can work with your key offline too, but you have to be aware that this is what you want when setting up- and it's very much not the happy path, so the site will not fully work as you might expect. Not faulting them, they provide the steps needed, but it might be annoying enough for some people to start uploading private keys.
- 10y ago
- Dowwie 10y agoThis is timely, considering Ken's recent hack attempt on his github account. Does anyone know what happens when commit signatures don't match?
- deleted 10y ago[deleted]
- Rafert 10y agoFor those out of the loop: http://www.kennethreitz.org/essays/on-cybersecurity-and-being-targeted http://www.kennethreitz.org/essays/on-cybersecurity-and-bein...
- eridius 10y agoThanks! That post just prompted me to check what password is on my DNS account, and it turns out to be an insecure one, so I'm fixing that right now.
- jbondo 10y agoThis setup seems a little simpler (doesn’t require Homebrew, for example): https://gist.github.com/danieleggert/b029d44d4a54b328c0bac65d46ba4c65 https://gist.github.com/danieleggert/b029d44d4a54b328c0bac65...
- pstadler 10y agoThanks for posting this here. Please note that this was initially written as a reference for myself, being relatively inexperienced with the keybase client and gpg tooling in general. There are certainly different ways to accomplish the same and you don't have to use keybase, but I wanted to. Please keep this in mind. Ironically, only the first commit is signed.
- underyx 10y ago>Ironically, only the first commit is signed. Yeah, and even though I had set this up myself just a few minutes before I submitted PR #3, I ended up committing on the web UI as well, with no signature :D
- aestetix 10y agoWhen does keybase plan to do nightly keydumps like SKS offers?
- rietta 10y agoBut what do you do with the signatures on the signed commits? It is of some, limited value, to GPG sign because it does provide a little bit more of "John Hancock" for a release, but how does this work in a continuous integration environment? Does the CI server reject commits that are not properly signed? Does the server refuse to run unsigned or incorrectly signed Git deployed code?
- mi100hael 10y agoIt provides a confirmation that the person who's name & email are on a commit actually made the commit. I can configure my instance of git to make commits as "Linus Torvalds <torvalds@linux-foundation.org>", but only the real Linus can sign them with a publicly-verifiable GPG key.
- sleepychu 10y ago># Push an encrypted copy of your new secret key to the Keybase.io server? [Y/n] Y What's the purpose of this? What attack vectors does it expose?
- FungalRaincloud 10y agoKeybase desires to act as a keyserver and public identity record, keeping your aggregated identity, and a backup of your public and private key pair. The latter is (read: should be) encrypted and only accessible to you. They make that optional, though, and will happily keep track of only your public key. It is absolutely optional, and it exposes you in one critical way: You have to take Keybase's word that they cannot (and will not develop the ability to) access your private key, even though it's on their servers. I don't use that feature, because I can't see an advantage to it. I can keep a paper copy of my private key in a safety deposit box, if I'm worried about having a secured backup of it that's out of my hands.
- benmanns 10y agoYou can use it to do actions on the Keybase site by typing in your decryption password. Attack vectors: Keybase site code gets replaced with something malicious, now they have your key password and decrypted private key. You can also do everything on the command line without trusting Keybase's server or their frontend JS.
- acdha 10y agoAnother problem: if their storage or a backup is compromised, the attackers can brute-force passwords offline without rate-limiting. In some ways that's worse than actively trojaning their JavaScript since there's no possible way for the target to know that's happened whereas the fronted at least has the low but non-zero chance of someone noticing the malicious code.
- fphilipe 10y agoI'm not sure keybase does this by default, but make sure to upload your key to a keyserver such as MIT's (https://pgp.mit.edu https://pgp.mit.edu). Otherwise, git will complain that the signature is invalid when doing `git log --show-signature`.
- libeclipse 10y agoGithub doesn't complain for me, so I can only assume that it does this itself. What I did was grab my key from keybase and inserted that into my local keyring, then uploaded that to my github.
- fphilipe 10y agoGitHub is happy as long as you upload the public key to GitHub. Git though uses pgp key servers to verify the signature.
- cyphar 10y agoThis is only true if the person looking at the repo doesn't have a copy of your key locally. It's important to remember that all of these tools work offline and don't require some web 2.0 service to operate. :P
- quchen 10y agoIf anyone wants in, here are 5 invite links. [Edit: all used up.] Each works for only one signup, so hurry up :-) By the way, most users get around 20 free invites shortly after signing up. If one of the links above opened your account, why not share five of your own invites afterwards?
- madssj 10y agoAnd should they run dry, here are some more invites: Edit: 25 people from HN now have a keybase account. Should anyone care, you can use: $.makeArray($("input.form-control[value]").map(function() {return $(this).val();})).join(" ") To produce a list of your active invites from the invite page.
- shadowfacts 10y agoI got the second one and just finished setting it up, thanks!
- pyvek 10y agoHere are some more – https://keybase.io/inv/cd1e58f4c6 https://keybase.io/inv/cd1e58f4c6 https://keybase.io/inv/561cd3baeb https://keybase.io/inv/561cd3baeb https://keybase.io/inv/c794a4ca38 https://keybase.io/inv/c794a4ca38 https://keybase.io/inv/5201b55fdd https://keybase.io/inv/5201b55fdd https://keybase.io/inv/f41ca64909 https://keybase.io/inv/f41ca64909
- songgao 10y agoHere are a couple more: https://keybase.io/inv/d1439a90ad https://keybase.io/inv/d1439a90ad https://keybase.io/inv/19ff7aba7d https://keybase.io/inv/19ff7aba7d https://keybase.io/inv/214f008a4f https://keybase.io/inv/214f008a4f https://keybase.io/inv/19949fe9a1 https://keybase.io/inv/19949fe9a1 https://keybase.io/inv/8c0d7ab033 https://keybase.io/inv/8c0d7ab033 https://keybase.io/inv/6e0e648a78 https://keybase.io/inv/6e0e648a78 https://keybase.io/inv/02bfae461c https://keybase.io/inv/02bfae461c https://keybase.io/inv/b643f5505 https://keybase.io/inv/b643f5505 https://keybase.io/inv/98155df989 https://keybase.io/inv/98155df989 https://keybase.io/inv/79f12dd484 https://keybase.io/inv/79f12dd484
- 10y ago
- zeveb 10y agoDisplaying the signature in the web UI is actually the only feature from GitHub I miss when using GitLab. It's not a huge deal, but it gives me a warm-and-fuzzy.
- mi100hael 10y agoIt's on their roadmap: https://gitlab.com/gitlab-org/gitlab-ce/issues/4232 https://gitlab.com/gitlab-org/gitlab-ce/issues/4232
- MikkoFinell 10y agoLinus Torvalds, the creator of Git, says that signing every commit is stupid. http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-td2582986.html http://git.661346.n2.nabble.com/GPG-signing-for-git-commit-t...
- andrewstuart2 10y agoAnd as noted nearly every time this 7-year-old comment by Torvalds is mentioned, this is of course technically correct due to the properties of git's Merkle tree, but completely impractical as far as the human implications. Consider: You've just written 20 lines of code, and you're creating a commit. Can you validate that all 20 lines were created by you before you commit? Now, consider that you're looking to create a tag for version 2.0, coming from 1.4, with a net 4,000 new lines of code. Can you quickly and confidently validate that all 4,000 lines of code are as expected? Clearly, the frequent, small validations are much simpler than infrequently signing huge releases. When integrity matters and humans are involved, small batches win.
- MikkoFinell 10y agoIf you autosign every commit then you aren't validating anything anyway. All that means is you have another mindless process running automatically in the background. So what's your point?
- viraptor 10y agoYou're talking about two different threats / attacks: 1. Someone got access allowing them to push commits. 2. Someone got access allowing them to push commits and also got unrestricted access to the trusted PGP key. In the first case, auto-signing will expose the issue. In the second, not. But in the second case, you're likely screwed in many other ways.
- GauntletWizard 10y agoLinus has a point, but it's not without flaws. Linus is saying that it makes you complacent, and doesn't prove anything about any release, and that you should sign golden commits. He says this because only what is shipped needs to be trustworthy; and the value of a signature degrades with the more things it signs. This raises the question, though; how do you know when you reach that golden commit? Is the signer responsible for auditing every commit since the last signature, every line of code? If he doesn't, what does the signature prove? That's what Linus has wrong; The signatures aren't about proof, they're about audit trail. For Linus and the kernel.org use case, this isn't necessary. They've already built tooling, and most importantly structure around the code auditing. Every commit that goes into the mainline is somewhat audited by Linus himself. There's a whole layer of competent release engineers in front of him. Code doesn't make it onto the kernel.org repos without having been trusted by a very select group, and doesn't get pulled to master without the word of God. I suggest, for the average developer, having two keys. One online, to verify that the commit was developed on your computer. One offline, that is only used for releases. One for audit trail, one for golden.
- jefffan241 10y agoI have 5 keybase invites free if anyone wants to take them. Edit: All invites taken
- koolba 10y agoWhy would I want to sign all (any?) of my commits? Releases sure, but every single one? What's the point? Tangentially on topic, when did keybase get that terrible logo? It looks like it'd be the mascot for an off-brand bag of potato chips.
- cyphar 10y agoOnly signing releases is equivalent to saying "every bit of code I just released I trust and so should you". This means that you have to have reviewed every change to make sure someone didn't dupe you into signing a commit you didn't mean to. Signing every commit is a much easier guarantee to make: "this change was made by me and I trust this change". In aggregate it's much better than just having signed releases (though of course you should sign releases in addition to this).
- diemscott 10y agoHere are some invites if you are interested. (added more, replaced some used ones) 16 used, here are more https://keybase.io/inv/b24a826ad7 https://keybase.io/inv/6875c4bf5a
- leemac 10y agoThanks for the invite! I'll reply here with a bunch when mine are available.
- ParadoxOryx 10y agoHere are a few as well: https://keybase.io/inv/16bbae7280 https://keybase.io/inv/ca4549544a https://keybase.io/inv/666215bb91 https://keybase.io/inv/417ae3ff89
- crench 10y agoHere's a few more: https://keybase.io/inv/f36d2463f7 https://keybase.io/inv/f36d2463f7 https://keybase.io/inv/902c91e375 https://keybase.io/inv/902c91e375 https://keybase.io/inv/3f4a976c17 https://keybase.io/inv/3f4a976c17 https://keybase.io/inv/39fa8415fc https://keybase.io/inv/39fa8415fc https://keybase.io/inv/42be11ea6f https://keybase.io/inv/42be11ea6f https://keybase.io/inv/6dada08bf1 https://keybase.io/inv/6dada08bf1 https://keybase.io/inv/c06f6585cb https://keybase.io/inv/c06f6585cb
- captn3m0 10y agoHere are a few more: https://keybase.io/inv/943528e525 https://keybase.io/inv/fa145b0e59 https://keybase.io/inv/3e259244ad https://keybase.io/inv/cfddcccc32
- pklausler 10y agoUsage note: "setup" is a noun, "set up" is a verb.
- csubj 10y agoInvites: https://keybase.io/inv/369352fa18 https://keybase.io/inv/369352fa18 https://keybase.io/inv/63ab4d212a https://keybase.io/inv/63ab4d212a
- Walkman 10y agoI also have a couple of keybase.io invitations: https://keybase.io/inv/23d5ce3afc https://keybase.io/inv/23d5ce3afc https://keybase.io/inv/bb28df44d6 https://keybase.io/inv/bb28df44d6 https://keybase.io/inv/bb9c4fffa8 https://keybase.io/inv/bb9c4fffa8 https://keybase.io/inv/471c1f67b7 https://keybase.io/inv/471c1f67b7 https://keybase.io/inv/44968be986 https://keybase.io/inv/44968be986 https://keybase.io/inv/cd6c91d01e https://keybase.io/inv/cd6c91d01e https://keybase.io/inv/cdc45eb48f https://keybase.io/inv/cdc45eb48f https://keybase.io/inv/41d268d0d6 https://keybase.io/inv/41d268d0d6 https://keybase.io/inv/b74615140f https://keybase.io/inv/b74615140f https://keybase.io/inv/d90ac04ed3 https://keybase.io/inv/d90ac04ed3
- olltre 10y agoSo do I :) https://keybase.io/inv/8cc6068c31 https://keybase.io/inv/8cc6068c31 https://keybase.io/inv/345f0dd4e2 https://keybase.io/inv/345f0dd4e2 https://keybase.io/inv/2d06418590 https://keybase.io/inv/2d06418590 https://keybase.io/inv/73fd612897 https://keybase.io/inv/73fd612897 https://keybase.io/inv/1e9acdc815 https://keybase.io/inv/1e9acdc815 https://keybase.io/inv/d5ae0a4b0c https://keybase.io/inv/d5ae0a4b0c
- eric_bullington 10y agoInvites: https://keybase.io/inv/4c100c57c9 https://keybase.io/inv/4c100c57c9 https://keybase.io/inv/89cb21a5a6 https://keybase.io/inv/89cb21a5a6
- moonka 10y agoMore Invites: https://keybase.io/inv/34fda59c6f https://keybase.io/inv/34fda59c6f https://keybase.io/inv/27f71dd95c https://keybase.io/inv/27f71dd95c https://keybase.io/inv/0ba37842db https://keybase.io/inv/0ba37842db https://keybase.io/inv/105ba8ef1e https://keybase.io/inv/105ba8ef1e https://keybase.io/inv/070ed67897 https://keybase.io/inv/070ed67897 https://keybase.io/inv/b5f6094a85 https://keybase.io/inv/b5f6094a85 https://keybase.io/inv/5f77883740 https://keybase.io/inv/5f77883740 https://keybase.io/inv/0cec6fa3d9 https://keybase.io/inv/0cec6fa3d9
- diego898 10y agoI have 22 invites left if anyone would like let me know!
- therealmarv 10y agoSomebody please explain to me: What's the point in signing on github when I can set the key on github itself (e.g. account gets compromised). A simple flag (on github's server) that is showing that my email on commit is the same as on the account would also do the job. What if my key is compromised and set a new one on github? What happens with my old signed commits? Another question: We are mostly no airplane mechanics which need to sign everything of our work. Why would you give up deniability of doing something (with your signed key) without thinking about the consequences? I'm thinking of legal cases here (hey you signed your commit!).
- mcpherrinm 10y agoGithub can't verify you actually committed a change unless it's signed. You can set whatever email address you want on any commit. They could verify who pushed it to github, since that action is authenticated, but restricting pushing other people's commits would break many workflows (eg, a bot pushing from a local git server), or a reviewer pushing code sent to a mailing list, or resolving conflicts in a merge locally. You can also verify the GPG key independently of Github. Perhaps your CI system could verify all commits it builds are signed, and your deployment system could too. There's no need to use Github as the authoritative source for that sort of thing.
- mwksl 10y agoTo continue the chain of invites, I have 22 available. You can contact me at matthew at leaguer [dot] io