4 ms·
I admit my ignorance of saltpack and keybase's implementation of it, but don't they propose storing the key for you? That seems to create a trust issue, which i
by stinkytaco 10y ago
I admit my ignorance of saltpack and keybase's implementation of it, but don't they propose storing the key for you? That seems to create a trust issue, which is precisely what the author is complaining people don't pay attention to, trust.
On the other hand, perhaps the argument for this would be a "trusted 3rd party" model (a la S/MIME).
- nickik 10y agoWell, you can have your GPG Private Key online if you like, but thats not my point. The new system moves away from having any sort of master key. Rather every device has a new key, and they all sign each other. You can add new devices without old proves being invalidated. See: https://keybase.io/blog/keybase-new-key-model https://keybase.io/blog/keybase-new-key-model and https://saltpack.org/ https://saltpack.org/ I would really like a solution using this stuff that is highly integrated with my mail client.
- stinkytaco 10y agoThat's an interesting solution. Rather than having keybase keep your key, your devices are communicating directly to validate each other? I'm going to have to review this in more detail, thanks.
- nickik 10y agoCurrently you have to use a paper key to do it. You then upload a public prove chain. Its not where it should be yet, but the concept is pretty good.