Comment by jeffbr13 | Hacker News Reader

Comment by jeffbr13 | Hacker News Reader

Parent Full thread

As you say in your post, PKSs already associate your public key with your email address as a unique identifier. But there are two points here:

1. Limiting identifiers to email addresses isn't that great a solution. Email is less popular amongst my generation (~20 y/o). It's the service backing almost every identity now, but I already have way too many email addresses which I have to check. What if I want to set up an anon identity? 2. Why, as a person on the street, would I trust pgp.mit.edu more than I trust Keybase THEN (Twitter AND a personal webpage AND whatever other services end up being supported) - it does ultimately depend on how much you trust Keybase, but not obviously so.

Looking back on it in a year or two, Keybase may end up a classic example of "worse is better", because it's easier to grasp, as you said in your post.

You shouldn't trust pgp.mit.edu, key servers are only there for easy distribution of keys (because that's easier than typing in multiple pages of base64), not for providing trust, trust is provided by the web of trust, that is to say, by the signatures of other people who have verified your identity (who in turn have signatures on their keys from yet other people who have verified their identity, and so on). Those signatures are part of the keys that get distributed through key servers, but it doesn't matter whether the key server is hostile, as the key server can not forge other people's signatures.

Also, as an aside: What went wrong there that people have a problem with "too many email addresses to check"? The great thing about email is that it is an interoperable system and you can do forwarding and stuff, so that you can easily have all your emails delivered to one common user interface, no matter how many addresses you have!? I also have quite a few addresses - but I don't "check" addresses, all my email automatically shows up in my one mutt inbox, which is the only thing I have to "check". That's very much in contrast to all those new, proprietary platforms that actively try to lock you in, among other things by forcing you to "check" every one of the platforms independently.

Reply on news.ycombinator.com