full-disclosure

Open Source and information security mailing list archives

Message-Id: <556B16A0-36DC-44B8-8027-C6A71CC15B0F@attilla.nl>
Date: Sat, 21 Jun 2014 20:30:32 +0200
From: Attilla de Groot <attilla@...illa.nl>
To: Rikairchy <blakcshadow@...il.com>
Cc: fulldisclosure@...lists.org
Subject: Re: [FD] keybase.io

Hi,

On 20 Jun 2014, at 22:22, Rikairchy <blakcshadow@...il.com> wrote:

> There is an option to create as well as upload your private key. I'm
> very new to this type of encryption, having only worked with
> Truecrypt, SSH, and Bitloccker prior, but I was under the impression
> that the private key was the last thing you should part with. Why
> would a website focused on providing security allow users to upload
> their private keys?

You are completely correct. That is why they discourage using this feature:

> Browser crypto can be scary. Do you have an evil extension installed? We can't tell. Further, have we been tortured into serving you custom, targeted JavaScript? Hopefully you're not that important.
> So: only use this page if (1) you feel your browser is clean and (2) a life doesn't depend on it.
> 
> Alternatively, the keybase program is open source and uses both GPG + the Keybase identity proofs API. It's great. 
> 

However, there are users that (for whatever reason) do want to use it.

— Attilla

Download attachment "signature.asc" of type "application/pgp-signature" (843 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives