3 ms·
I use KeyBase. Not long ago, one of my contacts deleted all their devices. So I got the skull-and-crossbones warning. Then they messaged me as a new account. N
by mirimir 8y ago
I use KeyBase. Not long ago, one of my contacts deleted all their devices. So I got the skull-and-crossbones warning. Then they messaged me as a new account.
Now this is an anonymous contact. There is no way that we will authenticate in meatspace. So I said "sorry", and pointed out that they should have shared a public GnuPG key with me before triggering a reset.
- mirimir 8y agoVery belated edit: That comes across as a bit heartless. I mean, we have no clue who each other are in meatspace. So why is a potential identity change so problematic? It's just the TFA example: > Bob (Eve): Hey Hey > Alice: Yo Bob! Looks like you got new safety numbers. > Bob (Eve): Yeah, I got the iPhone XS, nice phone, I'm really happy with it. Let's exchange safety numbers at RWC 2020. Hey - do you have Caroline's current address? Gonna surprise her while I'm in SF. > Alice: Bad call, Android 4 life! Yeah 555 Cozy Street. Now, I and my iffy correspondent have never shared anything actionable about third parties. But I do know a little about what he's doing, and have offered advice. And it would be very hard to continue doing that, without the risk of revealing potentially damaging information.
- jrochkind1 8y agoWait, how did you authenticate them the _first_ time? An anonymous contact who you will not meat in physical space who had no possible way to share a public GPG key with you prior to your original authentication...?
- mirimir 8y agoThey're just someone who contacted me, and asked for help with identity management, VMs, VPNs, OPSEC, etc, etc, etc. It's not uncommon, given how much I write online about that stuff. Sometimes, if they want too much hand holding, I request payment (Bitcoin). Sometimes I actually configure and test stuff for them, if they're willing to pay. But I have no clue who they are, and vice versa. Indeed, I emphasize that I don't want to know anything about what exactly they're up to. They could be hobbyists like me. Or criminals. Or cops. I mean, I have no way to know. So I don't worry about it. Basically it's TOFU. Ideally, they contact me via GnuPG encrypted email. So who they are is their public key, and an email address. Sometimes, for convenience, we more to Keybase or some other secure channel. But whatever, their identity is their public GnuPG key.
- jrochkind1 8y agoSo if they pretend to be a NEW person you've never talked to before, you're willing to talk to them again with a new key? :)
- mirimir 8y agoSure. Why not? I just won't talk about anything that I talked about before. It's exactly like someone asking questions about someone else. That all goes to /dev/null.
- jrochkind1 8y agoIf they start telling you the same stuff again, could be hard to keep track of which "identity" you learned what from.
- mirimir 8y agoIf something like that happened, I'd be taking notes.
- mirimir 8y agoAnonymity can be amusing. I have many other personas, besides Mirimir. None here on HN, of course. And I'm sure that many of my correspondents also have multiple personas. So a few times, I've wondered whether I was actually having multiple parallel conversations with someone, using different personas. But one just doesn't ask about such things. And at times, my contacts and I do that intentionally, to confuse observers.