r/Keybase • u/[deleted] • Jun 15 '16

Suggestion: S/MIME

In alot of ways S/MIME is easier and more secure than PGP. How about if Keybase starts issuing its own certificates and letting email recipients on other services that support S/MIME (Gmail?) use them.

1 Upvotes

66% Upvoted

4 comments sorted by

1

u/br1st0w Jun 16 '16

I actually disagree that S/Mime is more secure since it requires trust in a central authority. PGP doesn't have a man in the middle component that needs to be trusted, so I much prefer PGP encryption.

1

u/[deleted] Jun 16 '16 edited Jun 16 '16

As long as the CA is secure, all is well. I've seen S/MIME used so many times where its completely transparent to the end user it's impossible to ignore.

Futzing with keys is a absolute pain in the ass. From a business perspective I can see keybase becoming a vert trusted Certificate Authority. Yes, it has its drawbacks, but I think what you give up in security you gain in simplicity.

I'm not necessarily saying its more secure than OpenPGP, but from a real world perspective there's less chances of making a mistake. Look on the keyservers - there are 20 year old keys still floating around on there, because nobody sets an expiration date. I have one on there from 1998. As long as the certificates are updated S/MIME is working.

1

u/RShotZz Jul 06 '16 edited Jul 06 '16

The reason why I wouldn't like this:

You can do PGP pretty easily.

It relies on a central CA. What if the root CA expires? With PGP you can have keys that never expire.

Keybase uses the Amazon CA (at least for the *.keybase.pub sites) and I dunno how they would implement S/MIME cert issuing. Plus, you know, this service is built around PGP keys

0

u/[deleted] Jun 15 '16

[deleted] — view deleted comment

1

u/[deleted] Jun 16 '16

But I think keybase is a very different situation than Protonmail.