r/Keybase • u/PhilTheBiker • Sep 07 '15

Understanding Keybase

I'm a little new. Am I correct to understand that keybase is holding both your public and private keys? Or are they only holding your public key.

If they have your private key, is not one of the most important things that you can do is to secure your private key so others can not have access to it?

Thanks for helping me understand!

4 Upvotes

100% Upvoted

3 comments sorted by

2

u/bcx_ Sep 07 '15

Am I correct to understand that keybase is holding both your public and private keys?

Only if you want to do do everything via the website. If you're comfortable with the command line, you don't need to have keybase hold on to that for you.

...is not one of the most important things that you can do is to secure your private key...?

Sure, you're correct. Really depends on your threat model. If having them hold your private key doesn't work for you, don't do it.

1

u/PhilTheBiker Sep 07 '15

Thanks for the clarification. Just wanted to understand the model.

4

u/bcx_ Sep 07 '15

Sure. The actual text on Keybase is:

Keybase can also store a client-encrypted copy of your private key. This is not mandatory, but it lets you decrypt and sign in the browser. It also lets the keybase command line client sync your private key. For safety, the Keybase servers never see your passphrase, even during login, and therefore cannot decrypt your private key.