4 ms·

Signing an attestation without user consent is certainly a huge breach of Keybase’s trust, but describing this as a “backdoor” feels inaccurate.

sneak 7y ago
https://keybase.io/blog/2014-10-08/the-horror-of-a-secure-golden-key https://keybase.io/blog/2014-10-08/the-horror-of-a-secure-go... Keybase uses the term "backdoor" in their blog to describe an app using a key to sign another key as valid (violating user intent/consent).
- flurie 7y ago
  Your post would benefit from this information.
  - sneak 7y ago
    Updated.
- shawnz 7y ago
  That is not how they use the term at all. > A “golden key” is just another, more pleasant, word for a backdoor—something that allows people access to your data without going through you directly. Clearly in this situation nothing has been done to allow anyone else to access your data without consent. I get that you are upset about being made to look like you endorse a cryptocurrency, but that's not an excuse to be purposely misleading. You should edit the post and remove the backdoor claim.
  - vageli 7y ago
    They signed an attestation, that is essentially using your authority to say something is yours. I would consider my ability to consent as something that belongs to me. This change indeed allows people to access my data (in this case, saying I have something I don't, and using my authority without permission). If they automatically joined my keybase user to my hackernews profile without my consent, it would be just as egregious.
    - shawnz 7y ago
      You actually do have the key in question though, so they did not claim that you have something you don't. Furthermore the change did not give them more access than they had previously like you are subtly implying here. The app could already make attestations on behalf of the user since that is what it's designed to do. > If they automatically joined my keybase user to my hackernews profile without my consent, it would be just as egregious. Egregious, maybe, but also not a backdoor.
segmondy 7y ago
The point is that if keybase can sign the attestation on your behalf, they can further more sign other things on your behalf claiming it's you hence the reason he calls it a backdoor.

sneak 7y ago

https://keybase.io/blog/2014-10-08/the-horror-of-a-secure-golden-key https://keybase.io/blog/2014-10-08/the-horror-of-a-secure-go... Keybase uses the term "backdoor" in their blog to describe an app using a key to sign another key as valid (violating user intent/consent).

flurie 7y ago
Your post would benefit from this information.
- sneak 7y ago
  Updated.
shawnz 7y ago
That is not how they use the term at all. > A “golden key” is just another, more pleasant, word for a backdoor—something that allows people access to your data without going through you directly. Clearly in this situation nothing has been done to allow anyone else to access your data without consent. I get that you are upset about being made to look like you endorse a cryptocurrency, but that's not an excuse to be purposely misleading. You should edit the post and remove the backdoor claim.
- vageli 7y ago
  They signed an attestation, that is essentially using your authority to say something is yours. I would consider my ability to consent as something that belongs to me. This change indeed allows people to access my data (in this case, saying I have something I don't, and using my authority without permission). If they automatically joined my keybase user to my hackernews profile without my consent, it would be just as egregious.
  - shawnz 7y ago
    You actually do have the key in question though, so they did not claim that you have something you don't. Furthermore the change did not give them more access than they had previously like you are subtly implying here. The app could already make attestations on behalf of the user since that is what it's designed to do. > If they automatically joined my keybase user to my hackernews profile without my consent, it would be just as egregious. Egregious, maybe, but also not a backdoor.

segmondy 7y ago

The point is that if keybase can sign the attestation on your behalf, they can further more sign other things on your behalf claiming it's you hence the reason he calls it a backdoor.