4 ms·

Keybase has clearly moved away from PGP. They want to use Saltpack whenever possible, NaCl based encryption. They want to solve the problem of multiple devices

by nickik 10y ago

Keybase has clearly moved away from PGP. They want to use Saltpack whenever possible, NaCl based encryption. They want to solve the problem of multiple devices and not having to share the private key between all of them. As far as I know they are working on a messaging app as well.

Nadya 10y ago
They also have the KBFS which is very interesting. But yes, very clearly pivoted away from PGP and are working on other problems.
- nickik 10y ago
  I don't think they are working on other problems, rather they realised that GPG has limitations and they can not solve it with PGP. The problem they are working on, is the same problem they started with.
stinkytaco 10y ago
I admit my ignorance of saltpack and keybase's implementation of it, but don't they propose storing the key for you? That seems to create a trust issue, which is precisely what the author is complaining people don't pay attention to, trust. On the other hand, perhaps the argument for this would be a "trusted 3rd party" model (a la S/MIME).
- nickik 10y ago
  Well, you can have your GPG Private Key online if you like, but thats not my point. The new system moves away from having any sort of master key. Rather every device has a new key, and they all sign each other. You can add new devices without old proves being invalidated. See: https://keybase.io/blog/keybase-new-key-model https://keybase.io/blog/keybase-new-key-model and https://saltpack.org/ https://saltpack.org/ I would really like a solution using this stuff that is highly integrated with my mail client.
  - stinkytaco 10y ago
    That's an interesting solution. Rather than having keybase keep your key, your devices are communicating directly to validate each other? I'm going to have to review this in more detail, thanks.
    - nickik 10y ago
      Currently you have to use a paper key to do it. You then upload a public prove chain. Its not where it should be yet, but the concept is pretty good.

by nickik 10y ago

Nadya 10y ago

They also have the KBFS which is very interesting. But yes, very clearly pivoted away from PGP and are working on other problems.

nickik 10y ago
I don't think they are working on other problems, rather they realised that GPG has limitations and they can not solve it with PGP. The problem they are working on, is the same problem they started with.

stinkytaco 10y ago

I admit my ignorance of saltpack and keybase's implementation of it, but don't they propose storing the key for you? That seems to create a trust issue, which is precisely what the author is complaining people don't pay attention to, trust. On the other hand, perhaps the argument for this would be a "trusted 3rd party" model (a la S/MIME).

nickik 10y ago
Well, you can have your GPG Private Key online if you like, but thats not my point. The new system moves away from having any sort of master key. Rather every device has a new key, and they all sign each other. You can add new devices without old proves being invalidated. See: https://keybase.io/blog/keybase-new-key-model https://keybase.io/blog/keybase-new-key-model and https://saltpack.org/ https://saltpack.org/ I would really like a solution using this stuff that is highly integrated with my mail client.
- stinkytaco 10y ago
  That's an interesting solution. Rather than having keybase keep your key, your devices are communicating directly to validate each other? I'm going to have to review this in more detail, thanks.
  - nickik 10y ago
    Currently you have to use a paper key to do it. You then upload a public prove chain. Its not where it should be yet, but the concept is pretty good.