4 ms·
> plus one more feature I’ve always wanted: the ability to generate a keypair from a passphrase No. This is a bad feature. It turns your public key into a pass
by ryan-c 10y ago
> plus one more feature I’ve always wanted: the ability to generate a keypair from a passphrase
No. This is a bad feature. It turns your public key into a password hash, subject to cracking. This is a major footgun. Someone implemented this for bitcoin, called it a "brainwallet", and people lost large amounts of money due to not understanding the implications or how effective modern password cracking techniques are.
A more succinct breakdown on why this is foolish in this particular case:
> This means I can reliably access my archive keypair anywhere without doing something strange like uploading my private keys onto the internet.
Let us compare two cases:
1) Uploading private key to the internet, encrypted with a passphrase
2) Uploading public key to the internet, generated from a passphrase
In case 1, in addition to being encrypted, there is no reason to make it public, so it would likely be stored somewhere password protected. You can't attack it unless you have the file.
In case 2, the public key is, well public. You're basically handing it out to everyone to try to crack.
The result in case 2 is strictly worse security, for a very marginal increase in convenience.
Though, it seems the author simply published his encrypted private keys before: http://nullprogram.com/blog/2012/06/24/ http://nullprogram.com/blog/2012/06/24/
- orblivion 10y agoThis seems to be the danger that Keybase.io is convincing people to put themselves in as well huh.
- StavrosK 10y agoWhy do you say that? Keybase doesn't generate keys from passphrases.
- orblivion 10y agoThey have a feature wherein you store your password-protected private key onto their servers. By my reasoning (not being a cryptographer), if a passphrase isn't strong enough to protect your private data, it's not strong enough to protect my key, which in turn will no longer protect my private data. Let me know where I may be wrong on this. Here's a counterpoint: https://blog.filippo.io/on-keybase-dot-io-and-encrypted-private-key-sharing/ https://blog.filippo.io/on-keybase-dot-io-and-encrypted-priv... I don't understand it. If it really doesn't matter, why wouldn't it just derive the private key from the passphrase? I don't appreciate cryptographers appealing to some sort of common sense in the face of something another cryptographer has created.
- StavrosK 10y agoIn one case, you need just the passphrase. In the other case, you need the passphrase and to hack Keybase's servers, which is considerably harder.
- orblivion 10y agoIt's not hard if you're keybase. GPG isn't known for being based on trusting anybody other than yourself. Also note that the blogger (seemingly a security expert that people respect on here) I posted just went ahead and displayed their public key, to demonstrate that they're not afraid of Keybase or anybody else having it.
- StavrosK 10y agoThe original discussion was about generating keys from passphrases, which is much, much easier to exploit than what Keybase is doing. The discussion about whether Keybase's usability is worth the security tradeoff is one I'll leave to someone else.