<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">On Sep 9, 2014, at 1:09 PM, Tony Arcieri <<a href="mailto:bascule@gmail.com">bascule@gmail.com</a>> wrote:<div><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div>If you have your key fingerprint published through many channels, someone concerned with actually verifying your key fingerprint can check them all to ensure they match. If there's a discrepancy, something is probably amiss.</div><div><br></div><div>Perhaps an attacker managed to compromise them all and update your key fingerprints in all locations to confuse a victim into sending the attacker an encrypted message. Sure, it's not a great solution. It's an OK solution, however. Certainly better (from a security, not usability perspective) than TOFU.</div></div></div></div></blockquote><div><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div><br></div><div>I think it's important to remind us who we're dealing with.</div><div><br></div><div>The fact that Keybase lookups are done over HTTPS eliminates most malicious actors.</div><div><br></div><div>If Keybase pins their cert (do they?), that virtually guarantees the validity of the github and twitter URLs.</div><div><br></div><div>The lookup would proceed to those services, to which the keys are not pinned, so the scope widens a bit again, just enough to include the Five Eyes, the host companies themselves (twitter and github), and anyone who hacked them.</div><div><br></div><div>What are the capabilities of the Five Eyes?</div><div><br></div><div>I think many would agree they are capable of manipulating and/or censoring connections (HTTPS or not) in an automated fashion, but with some difficulty (and non-zero possibility of detection). That implies that most keys returned from Keybase would be accurate, but for a small fraction they might not be.</div><div><br></div><div>I'd summarize the quality of service Keybase provides like so:</div><div><br></div><div>- For 99% of cases, it does a great job.</div><div>- For maybe <1%, it could provide false answers.</div><div>- There is the possibility of DoS / censorship (given that it is a centralized service) for everyone.</div><div><br></div><div><blockquote type="cite"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">Short of things like Google's proposed CT-alike for E2E looking for dishonest Key Directories, I'm not sure how you do better.</div></div></div></blockquote><br></div><div>OpenBazaar has plans to do public key lookups for pseudonyms in Namecoin via DNSChain:</div><div><br></div><div><a href="https://github.com/OpenBazaar/OpenBazaar/issues/487">https://github.com/OpenBazaar/OpenBazaar/issues/487</a></div><div><br></div><div>That has the advantage of virtually guaranteeing correct responses, and the decentralized nature makes it mostly invulnerable to DoS and censorship.</div><div><br></div><div>- Greg</div></div></div></div></div><div> <br class="Apple-interchange-newline"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">--</span><br style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;">Please do not email me anything that you are not comfortable also sharing</span><span style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; display: inline !important; float: none;"> with the NSA.</span> </div> <br></div></body></html>