3 ms·

Keybase never has to know what your private key is or store it. So, yes, you are completely free to continue managing your private and public keys however you a

by corford 13y ago

Keybase never has to know what your private key is or store it. So, yes, you are completely free to continue managing your private and public keys however you are used to. Of course, managing and creating your own keys outside of keybase and then importing your public key in to it does mean you lose out on some of the convenience of the service but, like you say, it's too early to trust them with everything. This doesn't invalidate their novel approach to trust anchoring though (which you can fully partake in without having to hand over your private key).

orblivion 13y ago
> Keybase never has to know what your private key is or store it. So, yes, you are completely free to continue managing your private and public keys however you are used to. And if they did require my private key I could always just not use the service at all. This is sortof besides the point. I'm not concerned about being coerced into anything. I'm concerned that they're sending the wrong message. Do you remember when Facebook used to ask for your Gmail password before we had OAuth? Do you think that was cool too? > like you say, it's too early to trust them with everything I'm not saying it's too early to trust them with everything. I'm saying you should never trust anybody with your private key. I don't care if it's my best friend, giving my private key to somebody is one more place it can get discovered. PGP offers something unique in that it can give you a network without any trust. You can weather the storm of broken https and MITMs and get to the person you're talking to. The only thing it doesn't fix is somebody owning your desktop. This is a beautiful thing if you think about it, and this sort of thing would dilute it.
- corford 13y ago
  I pretty much agree with everything you've said but I think most of the worries are rendered harmless if keybase are clear and up front about the trade offs. If you have a need for cast iron privacy and security, don't use them. If, on the other hand, you just want a semi-secure solution that prevents run of the mill third parties from intercepting reasonably benign day to day communication then maybe the risk is worth the convenience. You could also maintain a second keypair unconnected to keybase for things that need to be really secure and private. For me, the interest is solely with their approach to trust anchoring. I like that it simultaneously provides a place to post a brief bio, a public key and a way to tie the key holder to github and/or twitter accounts. I'm using that part of their offering now but I have no intention of ever giving them my private key.

by corford 13y ago

orblivion 13y ago

> Keybase never has to know what your private key is or store it. So, yes, you are completely free to continue managing your private and public keys however you are used to. And if they did require my private key I could always just not use the service at all. This is sortof besides the point. I'm not concerned about being coerced into anything. I'm concerned that they're sending the wrong message. Do you remember when Facebook used to ask for your Gmail password before we had OAuth? Do you think that was cool too? > like you say, it's too early to trust them with everything I'm not saying it's too early to trust them with everything. I'm saying you should never trust anybody with your private key. I don't care if it's my best friend, giving my private key to somebody is one more place it can get discovered. PGP offers something unique in that it can give you a network without any trust. You can weather the storm of broken https and MITMs and get to the person you're talking to. The only thing it doesn't fix is somebody owning your desktop. This is a beautiful thing if you think about it, and this sort of thing would dilute it.

corford 13y ago
I pretty much agree with everything you've said but I think most of the worries are rendered harmless if keybase are clear and up front about the trade offs. If you have a need for cast iron privacy and security, don't use them. If, on the other hand, you just want a semi-secure solution that prevents run of the mill third parties from intercepting reasonably benign day to day communication then maybe the risk is worth the convenience. You could also maintain a second keypair unconnected to keybase for things that need to be really secure and private. For me, the interest is solely with their approach to trust anchoring. I like that it simultaneously provides a place to post a brief bio, a public key and a way to tie the key holder to github and/or twitter accounts. I'm using that part of their offering now but I have no intention of ever giving them my private key.