5 ms·

Keybase is centralized. The GPG keyserver pool is a decentralized gossip network of volunteer servers (I run one). https://sks-keyservers.net/status/ https://s

Keybase is centralized. The GPG keyserver pool is a decentralized gossip network of volunteer servers (I run one). https://sks-keyservers.net/status/ https://sks-keyservers.net/status/

WorldMaker 8y ago
Depends on what you think of their Blockchain/Merkle tree work, though. The attestation chain that Keybase uses is a public merkle tree, and though currently built to be centrally signed, at the root level, still has some built in decentralized redundancy at the user/client level. Interesting gray areas between easy determinations of whether or not something is centralized/decentralized or now. https://keybase.io/docs/server_security https://keybase.io/docs/server_security
eridius 8y ago
Keybase is a centralized service but AIUI you don't need to actually trust the centralized Keybase service because all the actual validation is performed client-side (i.e. verifying all the proofs that the people you follow have posted) and all of the changes people make to their profiles are publicly published as a chain that is then periodically embedded into the Bitcoin blockchain. As long as you're ok with relying on the keybase service being reachable and functional, trust is still decentralized and verifiable.
- diafygi 8y ago
  Correct. Relying on keybase's service to keep the PKI running is the definition of centralized architecture, no matter if it's publicly verifiable or not. Also, I'm not sure how easy it is to run a private keybase PKI (anyone done this before?). For GPG/SKS keyservers, you can spin up separate pools of keyservers for private PKI pretty easily.
- Boulth 8y ago
  Proofs are still stored on Keybase servers so if Keybase goes bust tomorrow it's all gone. For the record there is a way to encode Keybase-like proofs in plain OpenPGP: https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-01 https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-01 for some reason Keybase decided to keep this validation centralized.
NelsonMinar 8y ago
Yup, the "centralized" is what I meant by "modern take".

Keybase is centralized. The GPG keyserver pool is a decentralized gossip network of volunteer servers (I run one). https://sks-keyservers.net/status/ https://sks-keyservers.net/status/

WorldMaker 8y ago

Depends on what you think of their Blockchain/Merkle tree work, though. The attestation chain that Keybase uses is a public merkle tree, and though currently built to be centrally signed, at the root level, still has some built in decentralized redundancy at the user/client level. Interesting gray areas between easy determinations of whether or not something is centralized/decentralized or now. https://keybase.io/docs/server_security https://keybase.io/docs/server_security

eridius 8y ago

Keybase is a centralized service but AIUI you don't need to actually trust the centralized Keybase service because all the actual validation is performed client-side (i.e. verifying all the proofs that the people you follow have posted) and all of the changes people make to their profiles are publicly published as a chain that is then periodically embedded into the Bitcoin blockchain. As long as you're ok with relying on the keybase service being reachable and functional, trust is still decentralized and verifiable.

diafygi 8y ago
Correct. Relying on keybase's service to keep the PKI running is the definition of centralized architecture, no matter if it's publicly verifiable or not. Also, I'm not sure how easy it is to run a private keybase PKI (anyone done this before?). For GPG/SKS keyservers, you can spin up separate pools of keyservers for private PKI pretty easily.
Boulth 8y ago
Proofs are still stored on Keybase servers so if Keybase goes bust tomorrow it's all gone. For the record there is a way to encode Keybase-like proofs in plain OpenPGP: https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-01 https://tools.ietf.org/html/draft-vb-openpgp-linked-ids-01 for some reason Keybase decided to keep this validation centralized.

NelsonMinar 8y ago

Yup, the "centralized" is what I meant by "modern take".