3

Keybase's decryption page says "you must host your private key in Keybase's encrypted key store." This really rubs me the wrong way. I was under the impression that your private key should not leave your device, ever (Keybase even lets you have one private key for each non-web device).

But perhaps I'm wrong. Maybe all that is needed is to secure the host as in Protecting a PGP private keyring on host?

Is Keybase's methodology secure? I'm not seeing any documentation on their site of how they protect these keys (especially from themselves).

6

To be fair, the page states in full (emphasis mine):

To decrypt in the browser, you must be logged in, and you must host your private key in Keybase's encrypted key store.

Because browser clients lack the ability to store and access a local key, Keybase provides a server-side method. Yes, this method is less secure than their thick clients, where the private key never leaves the device.

Security-conscious users will want to avoid the browser client (and anybody using Keybase should be security-conscious, so I don't personally even understand why there is a browser client, but there you go...)

  • not everyone using Keybase will know anything about security. That is entirely the point of the product: they are trying to cater to your average Joe. Any other features of Keybase that your average Joe should be informed are unsafe for the uninitiated like him to use? – NH. Oct 14 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.