2 ms·
keybase.io is another centralized third party which, like Signal, we should be trying to move away from rather than becoming more dependent on. By relying on t
by dane-pgp 9y ago
keybase.io is another centralized third party which, like Signal, we should be trying to move away from rather than becoming more dependent on. By relying on the DNS (which is already trusted to make email, keybase.io, and Signal work), every service provider can be in control of the keys they are publishing.
Also, keybase.io, being centralized, isn't as auditable as the DNS, but admittedly there is work being done on both DNSSEC transparency:
http://blog.huque.com/2014/07/dnssec-key-transparency.html http://blog.huque.com/2014/07/dnssec-key-transparency.html
and keybase.io publishing to the bitcoin blockchain:
https://keybase.io/docs/server_security/merkle_root_in_bitcoin_blockchain https://keybase.io/docs/server_security/merkle_root_in_bitco...
- elahd 9y agoI'd say that it's only quasi centralized. At its core, keybase is a directory of signed statements posted on social media. Where space permits, these statements include the person's public key. Verifications can be checked directly on Facebook, Twitter, etc. without using keybase, somewhat decentralizing the service. As you mentioned, writing to blockchain pulls keybase further out of the equation. They're more of a facilitator for other applications -- Signal is a packaged application itself.