Name: Keybase
Homepage: https://keybase.io
Short description: Keybase already lets you import a PGP key so maybe that can be used as the proof? For example: https://keybase.io/lack_ shows I have a public key added, and clicking on that reveals the fingerprint, plus a link to download the key: https://keybase.io/lack_/pgp_keys.asc?fingerprint=189bc4bf734d674dd951ea27a7bd30d385cb62e5
Optional API documentation URL: https://keybase.io/docs/api/1.0
Add keybase
Looking at the API, this looks like a good thing to use for the proof, maybe:
(Example with my fingerprint)
Ha funny, I never considered adding Keybase as an identity claim.
That API gives a lot of information, and it directly gives the public key and the fingerprint. That is great!
I am trying to find downsides to using this claim. It's been years since I have used Keybase, can you just upload someone else's public key? Probably not. Do let me know if you know about this.
Yeah, this should be quite easy to implement!
yarmo Good question... I had to create an account first and be logged in to upload my key, so I think it's safe to assume that if you find a public key in a user's account, that user (or someone authenticated as that user) put the key there.
I don't think anything prevents me from uploading someone else's key into my profile, but isn't that the same as any proof in keyoxide? For example, I could upload a github gist with someone else's key fingerprint... That actually surprised me - I didn't have to upload a signed proof anywhere to get keyoxide working Though in this case maybe if I uploaded someone else's key I wouldn't be able to decrypt anything sent to me in keybase? That part I'm less clear on, but maybe there's more protection built-in to keybase than other proofs.
The assurance that keyoxide gives is less about whether the proof is cryptographically attached to the claim's PGP key, but more about whether the claim is signed by the same fingerprint contained in the proof, right? So in that respect it should be good? I'm not an expert in keybase though, just found it odd that keybase and keyoxide both have this same idea of "linked identities" but didn't know about eachother
lack I don't think anything prevents me from uploading someone else's key into my profile, but isn't that the same as any proof in keyoxide
Yes, you are absolutely right!
lack The assurance that keyoxide gives is less about whether the proof is cryptographically attached to the claim's PGP key, but more about whether the claim is signed by the same fingerprint contained in the proof, right?
Correct!
So yeah, nothing prevents us here from implementing Keybase as service provider. I'll give it a go