[Cryptography] Any opinions on keybase.io?

[Dennis E. Hamilton]

  -- Replying to --
From: cryptography [mailto:cryptography-bounces+dennis.hamilton=acm.org at metzdowd.com] On Behalf Of Judson Lester
Sent: Monday, December 15, 2014 15:56
To: John Ioannidis; cryptography mailing list
Subject: Re: [Cryptography] Any opinions on keybase.io?

On Mon Dec 15 2014 at 3:29:28 PM John Ioannidis <ji at tla.org> wrote:
I just found out about it, and judging by the use of a gray font and cutesy pictures on their website, I'm already prejudiced against it.

 I wrote something of a polemic against it a few months ago. I think the fundamental point they're making (crypto should be easier to use, and keys easier to exchange) is a good one, but the conclusions (centralize with us, send your private key over the network, use our encryption algorithm, etc etc) they draw are non sequitors and distressing.

[ ... ]

<orcnote>
I have never provided my private key to keybase.io.  That would be done if keybase.io generates a key for me, but it is not necessary and they explain that.  Although private keys they do hold are encrypted, I agree that is an unnecessary risk of disclosure, no matter how well-secured those private keys are.

My private key is on my GPG keyring and keybase.io doesn't have it, they just have the public key.  When I use the keybase.io local code to do signings of keybase challenges, those are performed by GPG after I provide my password to allow my private key to be used in a GPG operation.  That way, I'm not using any keybase.io encryption algorithms either.

I think that part is working fine.  And the claims that the entity having control of my keybase.io account, having the private key for the certificate associated with the account, and having the authority to carry out one of the challenges (e.g., put a special page on my web site, put a special message on my twitter account, put a special text on GitHub) seem rather strongly associated with me by those who recognize me in enough of those contexts.

I am not certain how well this works for folks who do not have some understanding of public-key methodologies.  I don't think they stick around after signing up because the accomplishments of operations with their key is still a mystery.

So it takes power users still.  I trust most of them will do what is required to install keybase.io on a local machine and not entrust their private keys to keybase.io.

There seems to be regular development activity, and the issues list has grown quite large, weighted towards feature requests and advanced usage, it seems to me.  There are occasional beginner questions and also some objections to the use of grey and light text on the site.  Accessibility of the site will become an issue, and that applies to the command-line keybase functions and PGP as well, I suppose.

It is still in alpha though.  There's much more to do to make this as effortless as they want.  Some mobile apps seem to be providing the missing pieces in a digestible form.
</orcnote>