4 ms·
># Push an encrypted copy of your new secret key to the Keybase.io server? [Y/n] Y What's the purpose of this? What attack vectors does it expose?
by sleepychu 10y ago
># Push an encrypted copy of your new secret key to the Keybase.io server? [Y/n] Y
What's the purpose of this? What attack vectors does it expose?
- FungalRaincloud 10y agoKeybase desires to act as a keyserver and public identity record, keeping your aggregated identity, and a backup of your public and private key pair. The latter is (read: should be) encrypted and only accessible to you. They make that optional, though, and will happily keep track of only your public key. It is absolutely optional, and it exposes you in one critical way: You have to take Keybase's word that they cannot (and will not develop the ability to) access your private key, even though it's on their servers. I don't use that feature, because I can't see an advantage to it. I can keep a paper copy of my private key in a safety deposit box, if I'm worried about having a secured backup of it that's out of my hands.
- benmanns 10y agoYou can use it to do actions on the Keybase site by typing in your decryption password. Attack vectors: Keybase site code gets replaced with something malicious, now they have your key password and decrypted private key. You can also do everything on the command line without trusting Keybase's server or their frontend JS.
- acdha 10y agoAnother problem: if their storage or a backup is compromised, the attackers can brute-force passwords offline without rate-limiting. In some ways that's worse than actively trojaning their JavaScript since there's no possible way for the target to know that's happened whereas the fronted at least has the low but non-zero chance of someone noticing the malicious code.