Hacker News Reader

you shouldn't put your private key in the cloud..? ..or maybe it is considered acceptable these days? theoretically--if you put your private key in cloud, and you pass the passphrase you give everything to the man in the middle for decrypting, but also give them the possibility to impersonating you.

View on HN

The private key can be stored in the cloud but is decrypted client-side with JS. If you have nefarious JS running (like from some evil extension), there is a risk, but there is not the opportunity for man-in-the-middle.

You don't have to put your private key on Keybase servers to use Keybase.

I noticed that you don't have to, but what is then the benefit of this web site..?

Seamless secure file sharing with decent identity authentication - https://keybase.io/docs/kbfs

it's only secure if you can ensure that no one has tampered with your keys. if your keys are generated behind a service like this, how can you know that you are safe?

You can use Keybase without their ever seeing your private key.

It's an easy way to exchange public keys and to introduce people to crypto.

Reply on news.ycombinator.com