4 ms·
The first thing I thought about is a man in the middle attack with homoglyphs. I don't know if I'm paranoid, but look at this > keybase id maria p
by riquito 13y ago
The first thing I thought about is a man in the middle attack with homoglyphs. I don't know if I'm paranoid, but look at this
> keybase id maria
pgp: C4B3 15B4 7154 5281 5100 1C58 C2A5 977B 0022
github: mаria_leah ✓ https://gist.github.com/23423
twitter: mаria_h20 ✓ https://t.co/mаria_h20/523554
site: mаriah20.com ✓ https://mаriah20.com/X904F...
I looked up for 'maria', all ascii.
The answer, served by a malicious server, contains the first 'a' of maria in Cyrillic (check yourself, you'll see that 'mаria_leah' != 'maria_leah'). This would fool the user.
Maybe the client should apply some logic as browsers do for IDN homograph attack to show characters not in your locale in a different way, or at least warn you.
- riquito 13y agoI wrote "man in the middle" attack, but that's wrong, since the connection is over https. The point is still valid if the server is compromised (or managed by evil people).
- malgorithms 13y agoHi riquito - this is a very legitimate concern, and it has to be reviewed individually for each type of proof keybase supports, in the client. With twitter, keybase, and github, you can't have a username containing any character other than an alphanumeric, dash, or underscore. Which means this kind of attack is impossible. But for future identity proofs (domains, for example, which we've yet to implement), this kind of attack is real. Our approach here will be that anything outside of normal ascii will be highlighted and addressed to the user, as a serious warning.
- riquito 13y agoThese are good news. Thank you and good work!