Hacker News Reader

Comment by neltnerb | Hacker News Reader

I signed up so long ago that I'm not quite sure what you mean. I remember posting a bunch of public keys (like on my profile here). I think the keybase app generated them along with a private key but it has been like three years.

I don't remember at all uploading one or where to find it if I did, can you explain the issue you have in mind a little more?

View on HN

You can optionally have Keybase (generate and) store your private key for you.

It's designed to lower the barrier to entry, but is obviously less secure than managing it yourself outside of Keybase (e.g. in GPG keyring, or a physical OpenPGP smartcard such as a Yubikey) - and some consequently wish the storage had never even been offered.

That optional GPG/PGP private key storage was also re-hidden (and almost but not quite removed) functionality by Keybase over the course of the application's life as they moved away from using traditional GPG/PGP-style keys to a more complicated but more secure system based on device-specific keys (and chains/webs of those keys and their derivatives), around when you needed another device to onboard the next device rather than just needing to sign in with username/password.

https://github.com/keybase/keybase-issues/issues/160

There is still (apparently under another command name) this ability to upload your private key.

The issue is a third-party having control of your private key.

Reply on news.ycombinator.com