5 ms·

https://pgp.mit.edu/ https://pgp.mit.edu/

by zelly 6y ago

chizhik-pyzhik 6y ago
keyservers don't work as a root of trust. look at all the 'satoshi nakamoto' keys supposedly from 2004 https://pgp.mit.edu/pks/lookup?search=Satoshi+Nakamoto&op=index https://pgp.mit.edu/pks/lookup?search=Satoshi+Nakamoto&op=in...
dijit 6y ago
That doesn't tie identity to keys. Not to mention it's notoriously slow and has been shown to be an insecure method of distributing keys (due to the fact that anybody can upload any key).
- zelly 6y ago
  Anyone can upload a key to keybase dot com too. You should never trust a key belongs to someone unless you have verified the fingerprint by other means e.g. speaking to them. This is basic security we have known since the 80s. Keybase dot com is a step backwards if anything because of the false sense of security it creates, as if they don't have a giant attack surface.
  - dewey 6y ago
    You don't understand what Keybase does. The whole point is that you don't just use it to upload a key. You link various verified identifies of yours across the web to your Keybase account so people know the PGP key there is the one of the verified person. It's a way to tie all your verified identifies together. If someone would manage to compromise a bunch of identities of someone on the internet, and then create a Keybase account with them and then upload a compromised PGP key that would be a problem if you don't verify the key. But that's a bit of a stretch.
    - efreak 6y ago
      In reality: I used keybase for a while. When I allowed a domain to expire and the DNS record disappeared, keybase threw up warning both in cli and their website that my identity verification couldn't be completed. My only problems I ever had with keybase was related to the cloud storage they offer. My real wish is that keybase supported ssh keys and would provide them as an agent.
      - namibj 6y ago
        You can revoke the DNS signature. I'll assume your keybase account name is the same as on HN. I do agree on the ssh key feature being nice, and, here's a link: https://keybase.io/blog/keybase-ssh-ca https://keybase.io/blog/keybase-ssh-ca You could also just use the keybase file system to keep ssh keys around.
fossuser 6y ago
Linking to this is evidence that you don't understand the entire value of Keybase. PGP sucks.
- zelly 6y ago
  Why? PGP works. (That alone puts it above its supposed alternatives.) It has existed for 30 yrs. That's 30 years of being exploited and patched. PGP (GnuPG at least) is lightweight. I don't need an Electron dependency or a multi-megabyte chat room in the same application (address space too?) that supposedly keeps my private keys safe. PGP is spoken by everyone, every programming language, having implementations on even ancient operating systems and architectures. Every email client worth its salt can use PGP. Emacs can decrypt and encrypt GnuPG-encrypted files seamlessly; other editors have plugins to do the same.
  - fossuser 6y ago
    It sucks because the UX is so bad that people don’t use it, even when their lives depend on it. [0] Even when they do use it, it’s easy to mess up. The biggest flaw though is that in person key signing parties were never a viable or realistic thing for identity verification and web of trust based on that works poorly as a result. The use of multiple signed public social media accounts for identity instead as a way to fix this was Keybase’s main innovation. For UX, even Snowden couldn’t get Greenwald to set up PGP and after multiple attempts Snowden eventually gave up and tried Laura Poitras with better results, the burden on the user is too high. [0] https://moxie.org/blog/gpg-and-me/ https://moxie.org/blog/gpg-and-me/
ccktlmazeltov 6y ago
this doesn't even have authenticated encryption
m4lvin 6y ago
Please, please, use https://keys.openpgp.org/ https://keys.openpgp.org/ instead! See https://keys.openpgp.org/about https://keys.openpgp.org/about for why.

https://pgp.mit.edu/ https://pgp.mit.edu/

by zelly 6y ago

https://pgp.mit.edu/ https://pgp.mit.edu/

keyservers don't work as a root of trust. look at all the 'satoshi nakamoto' keys supposedly from 2004 https://pgp.mit.edu/pks/lookup?search=Satoshi+Nakamoto&op=index https://pgp.mit.edu/pks/lookup?search=Satoshi+Nakamoto&op=in...

dijit 6y ago

That doesn't tie identity to keys. Not to mention it's notoriously slow and has been shown to be an insecure method of distributing keys (due to the fact that anybody can upload any key).

zelly 6y ago
Anyone can upload a key to keybase dot com too. You should never trust a key belongs to someone unless you have verified the fingerprint by other means e.g. speaking to them. This is basic security we have known since the 80s. Keybase dot com is a step backwards if anything because of the false sense of security it creates, as if they don't have a giant attack surface.
- dewey 6y ago
  You don't understand what Keybase does. The whole point is that you don't just use it to upload a key. You link various verified identifies of yours across the web to your Keybase account so people know the PGP key there is the one of the verified person. It's a way to tie all your verified identifies together. If someone would manage to compromise a bunch of identities of someone on the internet, and then create a Keybase account with them and then upload a compromised PGP key that would be a problem if you don't verify the key. But that's a bit of a stretch.
  - efreak 6y ago
    In reality: I used keybase for a while. When I allowed a domain to expire and the DNS record disappeared, keybase threw up warning both in cli and their website that my identity verification couldn't be completed. My only problems I ever had with keybase was related to the cloud storage they offer. My real wish is that keybase supported ssh keys and would provide them as an agent.
    - namibj 6y ago
      You can revoke the DNS signature. I'll assume your keybase account name is the same as on HN. I do agree on the ssh key feature being nice, and, here's a link: https://keybase.io/blog/keybase-ssh-ca https://keybase.io/blog/keybase-ssh-ca You could also just use the keybase file system to keep ssh keys around.

fossuser 6y ago

Linking to this is evidence that you don't understand the entire value of Keybase. PGP sucks.

zelly 6y ago
Why? PGP works. (That alone puts it above its supposed alternatives.) It has existed for 30 yrs. That's 30 years of being exploited and patched. PGP (GnuPG at least) is lightweight. I don't need an Electron dependency or a multi-megabyte chat room in the same application (address space too?) that supposedly keeps my private keys safe. PGP is spoken by everyone, every programming language, having implementations on even ancient operating systems and architectures. Every email client worth its salt can use PGP. Emacs can decrypt and encrypt GnuPG-encrypted files seamlessly; other editors have plugins to do the same.
- fossuser 6y ago
  It sucks because the UX is so bad that people don’t use it, even when their lives depend on it. [0] Even when they do use it, it’s easy to mess up. The biggest flaw though is that in person key signing parties were never a viable or realistic thing for identity verification and web of trust based on that works poorly as a result. The use of multiple signed public social media accounts for identity instead as a way to fix this was Keybase’s main innovation. For UX, even Snowden couldn’t get Greenwald to set up PGP and after multiple attempts Snowden eventually gave up and tried Laura Poitras with better results, the burden on the user is too high. [0] https://moxie.org/blog/gpg-and-me/ https://moxie.org/blog/gpg-and-me/

ccktlmazeltov 6y ago

this doesn't even have authenticated encryption

m4lvin 6y ago

Please, please, use https://keys.openpgp.org/ https://keys.openpgp.org/ instead! See https://keys.openpgp.org/about https://keys.openpgp.org/about for why.