[neko.py]

I've been looking at different kinds of applications of PGP for a while now out of interest, and I think that keybase is pretty cool. However, in order to use a lot of the features, you need to upload a private key to their "secure keystore." I'm not someone who's life depends on the security of my private key, but the point of PGP is security in the first place, so I like to try to be reasonably secure without impacting my quality of life too much.

Do you trust keybase? Thoughts on other PGP services? I think that if I do upload it, I'd use a subkey.

[Bish0pQ]

I do trust it, however that doesn't mean it's safe. It's always possible that they get hacked and keys get leaked. I think the company itself is honest that they're doing their best to protect their keys.

[mothered]

When I read the term "trust", to me, that's putting (100%) complete faith Into the given service. On these grounds, I don't trust anything.

In answer to your question, I more so trust It than not.

[neko.py]

thanks for the input folks I feel better about playing with the service now

[phyrrus9]

I wouldn't trust anything that needs you to give them your private key. By definition as soon as you do that, it's no longer a private key, and therefore no longer secure. What's wrong with gpg?

[neko.py]

I wouldn't trust anything that needs you to give them your private key. By definition as soon as you do that, it's no longer a private key, and therefore no longer secure. What's wrong with gpg?

There are things wrong with it that keybase tries, but fails to solve: mainly the barrier of entry and inconvenience. To be honest gnu privacy assistant helps a lot just by giving a frontend, but it still is kind of shit.

Keybase is nice because of the integrated gpg applications it provides, but yeah, I wouldnt trust it if my life was depending on it though.

[Pikami]

You know, keybase doesn't require you to send them your private key.
You can upload the public key.

[neko.py]

You know, keybase doesn't require you to send them your private key.
You can upload the public key.

Right, but it cant decrypt without the private key, apparently even from the cli on the box that the private key is stored... If i get a message I need to run it through gpg to decrypt unless im being stupid

[Pikami]

You know, keybase doesn't require you to send them your private key.
You can upload the public key.

Right, but it cant decrypt without the private key, apparently even from the cli on the box that the private key is stored... If i get a message I need to run it through gpg to decrypt unless im being stupid

It's better not to have keybase on your device, use GPG instead.

[Synthx]

I trust it, although like @Bish0pQ said, that doesn't mean it is always 100% secure. I signed up a while back and sadly never really touched it again.