4 ms·

Keybase is one version of a modern take on Web of Trust. https://keybase.io/ https://keybase.io/

diafygi 8y ago
Keybase is centralized. The GPG keyserver pool is a decentralized gossip network of volunteer servers (I run one). https://sks-keyservers.net/status/ https://sks-keyservers.net/status/
- WorldMaker 8y ago
  Depends on what you think of their Blockchain/Merkle tree work, though. The attestation chain that Keybase uses is a public merkle tree, and though currently built to be centrally signed, at the root level, still has some built in decentralized redundancy at the user/client level. Interesting gray areas between easy determinations of whether or not something is centralized/decentralized or now. https://keybase.io/docs/server_security https://keybase.io/docs/server_security
- eridius 8y ago
  Keybase is a centralized service but AIUI you don't need to actually trust the centralized Keybase service because all the actual validation is performed client-side (i.e. verifying all the proofs that the people you follow have posted) and all of the changes people make to their profiles are publicly published as a chain that is then periodically embedded into the Bitcoin blockchain. As long as you're ok with relying on the keybase service being reachable and functional, trust is still decentralized and verifiable.
  - diafygi 8y ago
    Correct. Relying on keybase's service to keep the PKI running is the definition of centralized architecture, no matter if it's publicly verifiable or not. Also, I'm not sure how easy it is to run a private keybase PKI (anyone done this before?). For GPG/SKS keyservers, you can spin up separate pools of keyservers for private PKI pretty easily.
  - Boulth 8y ago
    Proofs are still stored on Keybase servers so if Keybase goes bust tomorrow it's all gone. For the record there is a way to encode Keybase-like proofs in plain OpenPGP: https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-01 https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-01 for some reason Keybase decided to keep this validation centralized.
- NelsonMinar 8y ago
  Yup, the "centralized" is what I meant by "modern take".
ChrisSD 8y ago
Wow the mobile website really doesn't want me to know what keybase is.
- lallysingh 8y ago
  Yeah, their website says nothing until you hit the docs. But I've found the app quite useful. Essentially: a keyserver facility where you attest to your keys in public identities (like my hn profile), plus a bunch of end-to-end encrypted stuff built atop of it.
twothamendment 8y ago
I like keybase, I even got a bunch of my family to use it. To them it is just a free messaging app.I use it for messages and git. I still keep PGP/GnuPG keys up and working with email because it is universal and simple. The encrypted messages I have are easy to open and get on using a fresh machine/phone as long as I keep my key around. I don't depend on anyone to maintain their servers, etc. I'm still waiting for a modern replacement, but so far it hasn't happened for me.

Keybase is centralized. The GPG keyserver pool is a decentralized gossip network of volunteer servers (I run one). https://sks-keyservers.net/status/ https://sks-keyservers.net/status/

WorldMaker 8y ago
Depends on what you think of their Blockchain/Merkle tree work, though. The attestation chain that Keybase uses is a public merkle tree, and though currently built to be centrally signed, at the root level, still has some built in decentralized redundancy at the user/client level. Interesting gray areas between easy determinations of whether or not something is centralized/decentralized or now. https://keybase.io/docs/server_security https://keybase.io/docs/server_security
eridius 8y ago
Keybase is a centralized service but AIUI you don't need to actually trust the centralized Keybase service because all the actual validation is performed client-side (i.e. verifying all the proofs that the people you follow have posted) and all of the changes people make to their profiles are publicly published as a chain that is then periodically embedded into the Bitcoin blockchain. As long as you're ok with relying on the keybase service being reachable and functional, trust is still decentralized and verifiable.
- diafygi 8y ago
  Correct. Relying on keybase's service to keep the PKI running is the definition of centralized architecture, no matter if it's publicly verifiable or not. Also, I'm not sure how easy it is to run a private keybase PKI (anyone done this before?). For GPG/SKS keyservers, you can spin up separate pools of keyservers for private PKI pretty easily.
- Boulth 8y ago
  Proofs are still stored on Keybase servers so if Keybase goes bust tomorrow it's all gone. For the record there is a way to encode Keybase-like proofs in plain OpenPGP: https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-01 https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-01 for some reason Keybase decided to keep this validation centralized.
NelsonMinar 8y ago
Yup, the "centralized" is what I meant by "modern take".

ChrisSD 8y ago

Wow the mobile website really doesn't want me to know what keybase is.

lallysingh 8y ago
Yeah, their website says nothing until you hit the docs. But I've found the app quite useful. Essentially: a keyserver facility where you attest to your keys in public identities (like my hn profile), plus a bunch of end-to-end encrypted stuff built atop of it.

twothamendment 8y ago

I like keybase, I even got a bunch of my family to use it. To them it is just a free messaging app.I use it for messages and git. I still keep PGP/GnuPG keys up and working with email because it is universal and simple. The encrypted messages I have are easy to open and get on using a fresh machine/phone as long as I keep my key around. I don't depend on anyone to maintain their servers, etc. I'm still waiting for a modern replacement, but so far it hasn't happened for me.