+- Sinisterly (https://sinister.li)
+-- Forum: Computers (https://sinister.li/Forum-Computers)
+--- Forum: Software & Programs (https://sinister.li/Forum-Software-Programs)
+--- Thread: Do you trust Keybase? (/Thread-Do-you-trust-Keybase)
Do you trust Keybase? - neko.py - 02-25-2018
I've been looking at different kinds of applications of PGP for a while now out of interest, and I think that keybase is pretty cool. However, in order to use a lot of the features, you need to upload a private key to their "secure keystore." I'm not someone who's life depends on the security of my private key, but the point of PGP is security in the first place, so I like to try to be reasonably secure without impacting my quality of life too much.
Do you trust keybase? Thoughts on other PGP services? I think that if I do upload it, I'd use a subkey.
RE: Do you trust Keybase? - Bish0pQ - 02-26-2018
I do trust it, however that doesn't mean it's safe. It's always possible that they get hacked and keys get leaked. I think the company itself is honest that they're doing their best to protect their keys.
RE: Do you trust Keybase? - mothered - 02-26-2018
When I read the term "trust", to me, that's putting (100%) complete faith Into the given service. On these grounds, I don't trust anything.
In answer to your question, I more so trust It than not.
RE: Do you trust Keybase? - neko.py - 02-27-2018
thanks for the input folks
I feel better about playing with the service now
RE: Do you trust Keybase? - phyrrus9 - 03-01-2018
I wouldn't trust anything that needs you to give them your private key. By definition as soon as you do that, it's no longer a private key, and therefore no longer secure. What's wrong with gpg?
RE: Do you trust Keybase? - neko.py - 03-01-2018
(03-01-2018, 08:58 AM)phyrrus9 Wrote: I wouldn't trust anything that needs you to give them your private key. By definition as soon as you do that, it's no longer a private key, and therefore no longer secure. What's wrong with gpg?
There are things wrong with it that keybase tries, but fails to solve: mainly the barrier of entry and inconvenience. To be honest gnu privacy assistant helps a lot just by giving a frontend, but it still is kind of shit.
Keybase is nice because of the integrated gpg applications it provides, but yeah, I wouldnt trust it if my life was depending on it though.
RE: Do you trust Keybase? - Pikami - 03-01-2018
You know, keybase doesn't require you to send them your private key.
You can upload the public key.
RE: Do you trust Keybase? - neko.py - 03-01-2018
(03-01-2018, 11:17 AM)Pikami Wrote: You know, keybase doesn't require you to send them your private key.
You can upload the public key.
Right, but it cant decrypt without the private key, apparently even from the cli on the box that the private key is stored... If i get a message I need to run it through gpg to decrypt unless im being stupid
RE: Do you trust Keybase? - Pikami - 03-01-2018
(03-01-2018, 10:59 PM)neko.py Wrote:(03-01-2018, 11:17 AM)Pikami Wrote: You know, keybase doesn't require you to send them your private key.
You can upload the public key.
Right, but it cant decrypt without the private key, apparently even from the cli on the box that the private key is stored... If i get a message I need to run it through gpg to decrypt unless im being stupid
It's better not to have keybase on your device, use GPG instead.
RE: Do you trust Keybase? - Synthx - 03-02-2018
I trust it, although like @Bish0pQ said, that doesn't mean it is always 100% secure. I signed up a while back and sadly never really touched it again.