lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 21 Jun 2014 20:30:32 +0200
From: Attilla de Groot <attilla@...illa.nl>
To: Rikairchy <blakcshadow@...il.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] keybase.io

Hi,

On 20 Jun 2014, at 22:22, Rikairchy <blakcshadow@...il.com> wrote:

> There is an option to create as well as upload your private key. I'm
> very new to this type of encryption, having only worked with
> Truecrypt, SSH, and Bitloccker prior, but I was under the impression
> that the private key was the last thing you should part with. Why
> would a website focused on providing security allow users to upload
> their private keys?

You are completely correct. That is why they discourage using this feature:

> Browser crypto can be scary. Do you have an evil extension installed? We can't tell. Further, have we been tortured into serving you custom, targeted JavaScript? Hopefully you're not that important.
> So: only use this page if (1) you feel your browser is clean and (2) a life doesn't depend on it.
> 
> Alternatively, the keybase program is open source and uses both GPG + the Keybase identity proofs API. It's great. 
> 

However, there are users that (for whatever reason) do want to use it.


— Attilla

Download attachment "signature.asc" of type "application/pgp-signature" (843 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists