4 ms·
> In summary: how do you trust someone else's public key without phisically having access to it directly from them? You obtain the key's fingerprint in a secur
by dale_glass 5y ago
> In summary: how do you trust someone else's public key without phisically having access to it directly from them?
You obtain the key's fingerprint in a secure manner from them. They tell you directly, as in face-to-face, give you a business card where they printed the fingerprint, etc.
This is not a problem that's solvable automatically. Depending on your scenario, you may be more or less paranoid. Eg, you might sign your friend's key with minimum fuss, because you've known him since you were 12, and that's that. If it's a facility dealing with nuclear weapons then you probably ask for multiple forms of ID, a background check, and interview other people to be really sure this person is the right one to trust.
Once that is done, you sign their key with your. This can be uploaded to a keyserver. After that you don't need physical presence, because you trust your key, and that certifies what you trust unambigiously.
> If you get the key online, wow can you know that the source is definitely reliable and the channel of communication has not been compromised?
You sign their key yourself, or rely on somebody else's signature.
In a company, you'd have say, the sysadmin in charge of that.
* Alice is the sysadmin at Acme.
* Bob gets hired
* Bob is given a list of procedures to follow at the company, which include generating a key on his laptop, noting down the fingerprint somewhere (by hand, or printing it and verifying that just in case), and bringing it to Alice.
* Alice is trusting that the company's HR department really hired Bob Smith and not some impostor, and that somebody checked his ID. Alice then verifies the fingerprint to make sure she really has Bob's correct key.
* Alice then signs Bob's key with Acme's key. Bob in turn signs Acme's company key with the same process (obtaining the fingerprint from Alice).
* At that point, Carol can trust Bob's key because she went through the same process, trusts Acme's key, so can establish the chain of trust of Carol -> Acme -> Bob.
- pnutjam 5y agohttps://keybase.io/ https://keybase.io/ This is designed to handle key trust.
- sleepybrett 5y ago... and they got bought and it's not getting much work (if any at all) put into it. Shame.
- FabHK 5y agoWasn't that the problem keybase set out to solve, just replacing Acme with Github, Twitter, etc.? What happened to that effort?
- WorldMaker 5y agoZoom bought Keybase as what appeared to be an acquihire, so a lot of people assume the Keybase product itself is on ice (if not outright dead), and lot of distrust from early Zoom mistakes (their macOS uninstaller leaving behind an exploitable root daemon; the geopolitical distrust of their engineering teams in China and significant VC funding from Chinese sources; etc) leaves a lot of people concerned about the security of using Keybase moving forward under Zoom ownership.
- lapinot 5y agoMy personal worries about keybase are more about the coin-bs and unwanted features creeping in. There's no way keybase can be a contender to CAs if it has chat and file sync, it just needed to be a barebones toolkit that can be integrated and that can eventually get specified. But that wouldn't get you millions.
- WorldMaker 5y agoMy personal worries were always more about Keybase's business model. I respected the feature creep hustle. It's why the comparisons in the article here and the article it is a critique of use OpenPGP versus Signal as the comparatives. "Barebones toolkit" doesn't work, as we've never seen high, general user adoption of OpenPGP (or GPG or whatever), but Signal as a "messaging app first" has refined the PKI on-boarding enough that even some of my least technical friends can and do have Signal accounts. The "messaging app" is the front door that made sense to them. A regular user isn't going to think "I need to encrypt some stuff, so I'll pick up a toolkit like OpenPGP and then figure out how to use it, and then eventually figure out how to integrate it into my email or SMS client", a user is going to first want to "send a message to someone I know" and if it's secure that a beautiful bonus, but if it's convenient is general the bottom line. (Most users are not looking for Ikea/Lego solutions, they just want to go to the big box store and grab it off the shelf.) From that perspective, all of Keybase's features made a certain amount of sense. Maybe they had a few too many "front doors" (file sharing, [group] chat, git repo sharing, etc), but that's potentially more ways to get new users, more ways to explain to users why they might want good PKI in their lives without first explaining what PKI is or how it works. (Even the cryptocurrency BS has kind of sense to it from that perspective. Cryptocurrency wallets have been a lot of users' first introduction to PKI and how easy it is get wrong [all the variations on "I lost X Bitcoin because I didn't know the silly numbers mattered"]. With so many untrained users [badly] experiencing PKI for the first time with cryptocurrency, it does make a kind of sense for a PKI tool to try to show how to do it right/safely/user-friendly and integrate it with other PKI functions. [Regardless of whether or not you think encouraging general use of cryptocurrencies is a good idea in the first place.]) I just wish Keybase had gone into it with a business model that was tightly user-focused, strongly revenue generating, and less likely to get them acquihired into an entirely unrelated parent company.