3 ms·

They don't throw everything on the blockchain for no reason. They specifically back up the root of the merkel tree into the blockchain. Honestly, the OpenPGP w

by nickik 8y ago

They don't throw everything on the blockchain for no reason. They specifically back up the root of the merkel tree into the blockchain. Honestly, the OpenPGP world has so competently failed at usability and is only adopted by the most hard core of nerds. Even I have stopped using it for the most part. And that it is two steps back in security overall is just not true. Maybe in some individual features that you care about, but not in general. And the same thing counts that always counted, crypto that nobody is using is not protecting anything. The have mostly moved on from GPG any a different libraries now. The GPG is mostly a legacy feature.

Angostura 8y ago
> crypto that nobody is using is not protecting anything. There's only one thing that's worse. Crypto that people think is protecting them, but which isn't.
- nickik 8y ago
  Yeah but for the most part Keybase is not that. The person above point out one special case and not for the whole system. For the most part Keybase crypto is modern, effective and easy to use.
api 8y ago
> the OpenPGP world has so competently failed at usability Don't you know? There's a rule that all cryptographic software must be arcane and obscure and virtually impossible to use correctly by anyone other than obsessive nerds.
lrvick 8y ago
We already have a distributed backup system: the keyserver network. There are also efforts like DANE to put it in DNS. They however refuse to sync with it. They only sync with their own proprietary servers using their own protocol. Also there are projects in the OpenPGP world making very easy to use workflows and interfaces without centralizing or breaking standards. OpenKeychain for android is a fantastic example of this. I use OpenKeychain on my phone and can sign files, access passwords, or decrypt email by tapping my yubikey to it. I can tap someone elses key to my phone to import their key to my addressbook. No terminals or fuss and at no point does any key come in contact with system memory of any device involved so I have strong assurances it can't be stolen even if my phone is totally compromised. A big example of the 2 steps backwards of keybase: they use keys in system memory and abandoned any compatibility with the openpgp smartcard spec, yubikeys, etc. The industry is moving to smartcards for very good reason: malware is a thing and it can use/steal keys from system memory without user interaction. A key stored in a yubikey 4 OTOH never touches system memory and requires a physical touch for each operation. You can have usability without throwing out security and standards. Keybase is just another in a long line of companies ignorantly throwing out any security features they don't understand using usability as an excuse for bad engineering.
- Leace 8y ago
  > There are also efforts like DANE to put it in DNS. It seems GnuPG and "the ecosystem" is slowly moving to WKD (Web Key Directory) as it is easier to deploy (e.g. kernel.org is using it). If you put your binary key (gpg --export 36C8AAA9) at https://lrvick.net/.well-known/openpgpkey/hu/gfoh5t79df9raqtiz8f6gsg8urexr9wo https://lrvick.net/.well-known/openpgpkey/hu/gfoh5t79df9raqt... tools would retrieve it automatically when using your e-mail address (gpg --locate-key $EMAIL). (I got the hash by running gpg -k --with-wkd 36C8AAA9). This is supported by GnuPG, OpenKeychain and some e-mail clients: Enigmail, GpgOL (Outlook) would fetch your key in background when someone is writing an e-mail. For details see: https://wiki.gnupg.org/WKD#Implementations https://wiki.gnupg.org/WKD#Implementations The spec: https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-service/ https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-s...
nh2 8y ago
> OpenPGP ... is only adopted by the most hard core of nerds. This seems pretty inaccurate. * Lots of software projects sign their releases with PGP. * Almost all Linux distributions sign their software with PGP. If you use Linux, your security relies critically PGP. * Github has support for PGP, and I see people use it. * My random server hoster happens to sign all their emails with PGP. You could claim that all these systems are run "by the most hard core of nerds", but at that point the statement loses its relevance.
- lrvick 8y ago
  Even Facebook for all their privacy failings supports it. You can add your public key to your profile and they will encrypt all emails to you.
- arglebarnacle 8y ago
  The GP was pretty clearly talking about PGP in the context of ordinary encrypted communication between people (like email). Keybase isn't competing with PGP for signing releases. In the field that we are talking about, PGP has absolutely failed to gain widespread traction outside a certain hard core group of nerds.
- jedberg 8y ago
  Those aren't a representative sample of computer users though. Those are in fact the most hard core of nerds. If you want to take a poll of users, look at even keybase users (already highly biased). How many of them use the PGP key that they had to create when they signed up? I know I don't.

by nickik 8y ago

Angostura 8y ago

> crypto that nobody is using is not protecting anything. There's only one thing that's worse. Crypto that people think is protecting them, but which isn't.

nickik 8y ago
Yeah but for the most part Keybase is not that. The person above point out one special case and not for the whole system. For the most part Keybase crypto is modern, effective and easy to use.

api 8y ago

> the OpenPGP world has so competently failed at usability Don't you know? There's a rule that all cryptographic software must be arcane and obscure and virtually impossible to use correctly by anyone other than obsessive nerds.

lrvick 8y ago

We already have a distributed backup system: the keyserver network. There are also efforts like DANE to put it in DNS. They however refuse to sync with it. They only sync with their own proprietary servers using their own protocol. Also there are projects in the OpenPGP world making very easy to use workflows and interfaces without centralizing or breaking standards. OpenKeychain for android is a fantastic example of this. I use OpenKeychain on my phone and can sign files, access passwords, or decrypt email by tapping my yubikey to it. I can tap someone elses key to my phone to import their key to my addressbook. No terminals or fuss and at no point does any key come in contact with system memory of any device involved so I have strong assurances it can't be stolen even if my phone is totally compromised. A big example of the 2 steps backwards of keybase: they use keys in system memory and abandoned any compatibility with the openpgp smartcard spec, yubikeys, etc. The industry is moving to smartcards for very good reason: malware is a thing and it can use/steal keys from system memory without user interaction. A key stored in a yubikey 4 OTOH never touches system memory and requires a physical touch for each operation. You can have usability without throwing out security and standards. Keybase is just another in a long line of companies ignorantly throwing out any security features they don't understand using usability as an excuse for bad engineering.

Leace 8y ago
> There are also efforts like DANE to put it in DNS. It seems GnuPG and "the ecosystem" is slowly moving to WKD (Web Key Directory) as it is easier to deploy (e.g. kernel.org is using it). If you put your binary key (gpg --export 36C8AAA9) at https://lrvick.net/.well-known/openpgpkey/hu/gfoh5t79df9raqtiz8f6gsg8urexr9wo https://lrvick.net/.well-known/openpgpkey/hu/gfoh5t79df9raqt... tools would retrieve it automatically when using your e-mail address (gpg --locate-key $EMAIL). (I got the hash by running gpg -k --with-wkd 36C8AAA9). This is supported by GnuPG, OpenKeychain and some e-mail clients: Enigmail, GpgOL (Outlook) would fetch your key in background when someone is writing an e-mail. For details see: https://wiki.gnupg.org/WKD#Implementations https://wiki.gnupg.org/WKD#Implementations The spec: https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-service/ https://datatracker.ietf.org/doc/draft-koch-openpgp-webkey-s...

nh2 8y ago

> OpenPGP ... is only adopted by the most hard core of nerds. This seems pretty inaccurate. * Lots of software projects sign their releases with PGP. * Almost all Linux distributions sign their software with PGP. If you use Linux, your security relies critically PGP. * Github has support for PGP, and I see people use it. * My random server hoster happens to sign all their emails with PGP. You could claim that all these systems are run "by the most hard core of nerds", but at that point the statement loses its relevance.

lrvick 8y ago
Even Facebook for all their privacy failings supports it. You can add your public key to your profile and they will encrypt all emails to you.
arglebarnacle 8y ago
The GP was pretty clearly talking about PGP in the context of ordinary encrypted communication between people (like email). Keybase isn't competing with PGP for signing releases. In the field that we are talking about, PGP has absolutely failed to gain widespread traction outside a certain hard core group of nerds.
jedberg 8y ago
Those aren't a representative sample of computer users though. Those are in fact the most hard core of nerds. If you want to take a poll of users, look at even keybase users (already highly biased). How many of them use the PGP key that they had to create when they signed up? I know I don't.