> If sharing a password-protected private key is perfectly safe, why bother having them? Why don't PGP users just password protect everything? What’s “sharing”

> If sharing a password-protected private key is perfectly safe, why bother having them? Why don't PGP users just password protect everything? What’s “sharing” here? You “share” an encrypted private key with Keybase so you yourself can recover it back from anywhere using the password that you know. PGP, meanwhile, is used for communication with people who are not you. > If people have bad passwords, that makes brute force recovery of the private key on a Keybase server plausible, right? At least a lot more so than the whole key from scratch. Yes. If you want to upload an encrypted copy of your key to someone you wouldn’t trust with the key, you should use a strong password. > I'd assume that a machine generated key has more entropy than any password that a human can memorize. That’s not a correct assumption, but your password doesn’t have to be more complex than the key to be safe against brute force anyway, especially when work is added with scrypt (which is what Keybase uses).