7 ms·

Is keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?

by akerro 10y ago

daveguy 10y ago
Edit: I think I found it -- generally referred to as keyservers? Here is a stackexchange post: http://superuser.com/questions/227991/where-to-upload-pgp-public-key-are-keyservers-still-surviving http://superuser.com/questions/227991/where-to-upload-pgp-pu... Can someone please give examples of key-exchange services or server applications? I am getting a bunch of Microsoft exchange results when I try to google it.
- snassar 10y ago
  The go-to keyserver software is SKS https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Home https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Home and the network of SKS Keyservers can be found at: https://sks-keyservers.net/ https://sks-keyservers.net/ Things to know about keyservers such as SKS: There is no way to remove keys or a way to really delete information. Uploading to know server will propagate that information to all SKS servers in the network over time.
mapleoin 10y ago
AFAIK keybase.io is not meant as a key exchange server. You should publish your keys using an existing exchange server.
- camiller 10y ago
  Exactly! It would be nice if keybase.io had a simple click this button to publish your public key to common key exchange servers. But it isn't that hard to do it manually.
- davexunit 10y ago
  The problem is that AFAIK they don't tell their users that anywhere, and I often encounter people that only have their key on Keybase and it's a real pain to import their key.
  - StavrosK 10y ago
    How much of a pain is it? You just click on the fingerprint on their page, no? https://keybase.io/stavros https://keybase.io/stavros
    - akerro 10y ago
      OK, I clicked. Where is your email address? Was that stawros or stavros? Do I really need to copy the key or .asc address, wget it and import? How do I know if that's your latest key? Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? THERE MUST BE AN EASIER WAY! Ehh screw that. I'll write it in plaintext.
      - StavrosK 10y ago
        > Where is your email address? Was that stawros or stavros? It's right in the key! > Do I really need to copy the key or .asc address, wget it and import? Is this a failure of keybase? You import it as with any other key, "decrypt from clipboard" in your favorite manager, or similar. > How do I know if that's your latest key? I don't know, how do you know that with a keyserver? > Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? Again, same as any other keyserver. > THERE MUST BE AN EASIER WAY! It seems that the frustration is with the PGP client, rather than keybase or the server, though.
      - WorldMaker 10y ago
        Keybase has a pretty good command line tool and commands very similar to ones in the article we are commenting upon can be used to grab the public key of a Keybase user using just their Keybase username. It should probably be easy to presume that if a user gives you their Keybase username they are telling you it's the easiest way to get their most up-to-date key(s) and revocations and that they are actively managing it. (Pretty much the same assumption any time anyone ever suggests to you a specific keyserver over just a fingerprint and keyserver roulette; that's probably the keyserver they actively check/update/revoke and will be the timeliest.)
snassar 10y ago
I don't really get what keybase.io is supposed to solve, but it doesn't get in the way of importing keys into Enigmail. If you are in Enigmail's Keymanager you can import from a URL when the content is well-formatted. Examples that work: https://keybase.io/snassar/key.asc https://keybase.io/snassar/key.asc https://pgp.samirnassar.com https://pgp.samirnassar.com http://keys.gnupg.net/pks/lookup?op=get&search=0x69A75542488B4A1A http://keys.gnupg.net/pks/lookup?op=get&search=0x69A75542488... It would be nice if Keybase made the URL more easily "gettable" instead of hiding it behind 2 clicks.
- akerro 10y ago
  Keybase was created by NSA to make pgp/gpg harder...
- WorldMaker 10y ago
  «I don't really get what keybase.io is supposed to solve» Keybase was built to solve the "web of trust" bootstrap problem [1] by leveraging the web of social media profiles a user typically has with simple replicable proofs of social media identity. [1] Arguably the hardest problem in PKI: how do you get user to trust that a public key is for the right person? In the classic PGP/GPG web of trust you do things like "key signing parties" and physical in real life interactions and deciding your threshold for how far you trust the friend of my friend signed this key. In the Keybase model you can see that the key (or family of keys) are tied to a certain combo of Twitter, Facebook, HN, et al accounts/profiles and generally trust that the person with all those accounts is the person you are trying to communicate with.
  - snassar 10y ago
    Fair enough, when it comes to coming up with creative ways to solve the web of trust problem. I still do not know what problem keybase.io solves when they allow uploading of private keys.
    - WorldMaker 10y ago
      That would be the second hardest problem in PKI: key escrow and key management. The answers to the questions most average users have like: What do I do if I lose my machine? If I'm logged in from the library or work or my friend's PC? If I use multiple machines every day? When the "right" answer includes "Print out this long thing, put it in a safe deposit box, and pray you never have to type in this long string of numbers", you immediately lose a lot of potential users; it doesn't quite fit the "Grandparent test" (could your Grandparent use it?). Absolutely there's a trade-off in trusting a 3rd Party key escrow, but there's an immense usability benefit to average users that want something easier to do and "some security" really can be better than "no security", even if a lot of hard-line paranoid wonks have good reason to believe otherwise.
davexunit 10y ago
Yes. Keybase is trying to make a walled garden for itself. I got really frustrated by this a couple weeks ago when I needed to get a key from a contractor but it was only on Keybase, which at the time I thought could be used as a GPG keyserver.
eeeeeeeeeeeee 10y ago
Just because something is useless to you does not mean it's useless to everyone else. There are clearly a lot of people using Keybase.

Is keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?

by akerro 10y ago

Is keybase.io still mostly useless because it is not compatible with other key-exchange servers and can't be easily added to Enigma in Thunderbird?

daveguy 10y ago

Edit: I think I found it -- generally referred to as keyservers? Here is a stackexchange post: http://superuser.com/questions/227991/where-to-upload-pgp-public-key-are-keyservers-still-surviving http://superuser.com/questions/227991/where-to-upload-pgp-pu... Can someone please give examples of key-exchange services or server applications? I am getting a bunch of Microsoft exchange results when I try to google it.

snassar 10y ago
The go-to keyserver software is SKS https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Home https://bitbucket.org/skskeyserver/sks-keyserver/wiki/Home and the network of SKS Keyservers can be found at: https://sks-keyservers.net/ https://sks-keyservers.net/ Things to know about keyservers such as SKS: There is no way to remove keys or a way to really delete information. Uploading to know server will propagate that information to all SKS servers in the network over time.

mapleoin 10y ago

AFAIK keybase.io is not meant as a key exchange server. You should publish your keys using an existing exchange server.

camiller 10y ago
Exactly! It would be nice if keybase.io had a simple click this button to publish your public key to common key exchange servers. But it isn't that hard to do it manually.
davexunit 10y ago
The problem is that AFAIK they don't tell their users that anywhere, and I often encounter people that only have their key on Keybase and it's a real pain to import their key.
- StavrosK 10y ago
  How much of a pain is it? You just click on the fingerprint on their page, no? https://keybase.io/stavros https://keybase.io/stavros
  - akerro 10y ago
    OK, I clicked. Where is your email address? Was that stawros or stavros? Do I really need to copy the key or .asc address, wget it and import? How do I know if that's your latest key? Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? THERE MUST BE AN EASIER WAY! Ehh screw that. I'll write it in plaintext.
    - StavrosK 10y ago
      > Where is your email address? Was that stawros or stavros? It's right in the key! > Do I really need to copy the key or .asc address, wget it and import? Is this a failure of keybase? You import it as with any other key, "decrypt from clipboard" in your favorite manager, or similar. > How do I know if that's your latest key? I don't know, how do you know that with a keyserver? > Did not you revoke it last week and forgot to update keybase but didn't forget to update your blog? Again, same as any other keyserver. > THERE MUST BE AN EASIER WAY! It seems that the frustration is with the PGP client, rather than keybase or the server, though.
    - WorldMaker 10y ago
      Keybase has a pretty good command line tool and commands very similar to ones in the article we are commenting upon can be used to grab the public key of a Keybase user using just their Keybase username. It should probably be easy to presume that if a user gives you their Keybase username they are telling you it's the easiest way to get their most up-to-date key(s) and revocations and that they are actively managing it. (Pretty much the same assumption any time anyone ever suggests to you a specific keyserver over just a fingerprint and keyserver roulette; that's probably the keyserver they actively check/update/revoke and will be the timeliest.)

snassar 10y ago

I don't really get what keybase.io is supposed to solve, but it doesn't get in the way of importing keys into Enigmail. If you are in Enigmail's Keymanager you can import from a URL when the content is well-formatted. Examples that work: https://keybase.io/snassar/key.asc https://keybase.io/snassar/key.asc https://pgp.samirnassar.com https://pgp.samirnassar.com http://keys.gnupg.net/pks/lookup?op=get&search=0x69A75542488B4A1A http://keys.gnupg.net/pks/lookup?op=get&search=0x69A75542488... It would be nice if Keybase made the URL more easily "gettable" instead of hiding it behind 2 clicks.

akerro 10y ago
Keybase was created by NSA to make pgp/gpg harder...
WorldMaker 10y ago
«I don't really get what keybase.io is supposed to solve» Keybase was built to solve the "web of trust" bootstrap problem [1] by leveraging the web of social media profiles a user typically has with simple replicable proofs of social media identity. [1] Arguably the hardest problem in PKI: how do you get user to trust that a public key is for the right person? In the classic PGP/GPG web of trust you do things like "key signing parties" and physical in real life interactions and deciding your threshold for how far you trust the friend of my friend signed this key. In the Keybase model you can see that the key (or family of keys) are tied to a certain combo of Twitter, Facebook, HN, et al accounts/profiles and generally trust that the person with all those accounts is the person you are trying to communicate with.
- snassar 10y ago
  Fair enough, when it comes to coming up with creative ways to solve the web of trust problem. I still do not know what problem keybase.io solves when they allow uploading of private keys.
  - WorldMaker 10y ago
    That would be the second hardest problem in PKI: key escrow and key management. The answers to the questions most average users have like: What do I do if I lose my machine? If I'm logged in from the library or work or my friend's PC? If I use multiple machines every day? When the "right" answer includes "Print out this long thing, put it in a safe deposit box, and pray you never have to type in this long string of numbers", you immediately lose a lot of potential users; it doesn't quite fit the "Grandparent test" (could your Grandparent use it?). Absolutely there's a trade-off in trusting a 3rd Party key escrow, but there's an immense usability benefit to average users that want something easier to do and "some security" really can be better than "no security", even if a lot of hard-line paranoid wonks have good reason to believe otherwise.

davexunit 10y ago

Yes. Keybase is trying to make a walled garden for itself. I got really frustrated by this a couple weeks ago when I needed to get a key from a contractor but it was only on Keybase, which at the time I thought could be used as a GPG keyserver.

eeeeeeeeeeeee 10y ago

Just because something is useless to you does not mean it's useless to everyone else. There are clearly a lot of people using Keybase.