36 ms·
Anyone can upload a key to keybase dot com too. You should never trust a key belongs to someone unless you have verified the fingerprint by other means e.g. spe
by zelly 6y ago
Anyone can upload a key to keybase dot com too. You should never trust a key belongs to someone unless you have verified the fingerprint by other means e.g. speaking to them. This is basic security we have known since the 80s. Keybase dot com is a step backwards if anything because of the false sense of security it creates, as if they don't have a giant attack surface.
- dewey 6y agoYou don't understand what Keybase does. The whole point is that you don't just use it to upload a key. You link various verified identifies of yours across the web to your Keybase account so people know the PGP key there is the one of the verified person. It's a way to tie all your verified identifies together. If someone would manage to compromise a bunch of identities of someone on the internet, and then create a Keybase account with them and then upload a compromised PGP key that would be a problem if you don't verify the key. But that's a bit of a stretch.
- efreak 6y agoIn reality: I used keybase for a while. When I allowed a domain to expire and the DNS record disappeared, keybase threw up warning both in cli and their website that my identity verification couldn't be completed. My only problems I ever had with keybase was related to the cloud storage they offer. My real wish is that keybase supported ssh keys and would provide them as an agent.
- namibj 6y agoYou can revoke the DNS signature. I'll assume your keybase account name is the same as on HN. I do agree on the ssh key feature being nice, and, here's a link: https://keybase.io/blog/keybase-ssh-ca https://keybase.io/blog/keybase-ssh-ca You could also just use the keybase file system to keep ssh keys around.