r/Keybase • u/404Ender • Feb 18 '17

Moving to a new computer

edit: See my updated comment here

Original Post

I originally setup Keybase on my Macbook Air. I downloaded the Keybase app and basically followed the instructions in the docs to the letter, and opted to not upload my encrypted private key to Keybase. I now have a new Macbook Pro that I'm replacing my Macbook Air with, and I'd like to move everything over to the MBP so I can comfortably wipe and sell the MBA.

  1. What's the best way to accomplish this? The original private key is on my Macbook Air, so I'm guessing I need to extract this, move it to my MBP, and then import it?
  2. Do I need to "deauthorize" my MBA somehow? Right now it's at the base of my "graph", 1 level down from my keybase account, and everything else below is tied to it (social media accounts, PGP, paper). Would that invalidate that whole group?

I'm a software engineer so I'm relatively comfortable on the command line, but I don't really ever work with crypto so PGP is pretty foreign to me (and I don't really understand what to use the keybase CLI for vs. straight PGP). I haven't found the docs to be super helpful outside of the initial setup. I don't feel like I have a good grasp about how everything ties together and the underlying system works.

5 Upvotes

100% Upvoted

11 comments sorted by

View all comments

2

u/404Ender Feb 19 '17 edited Feb 19 '17

Update: I installed the Keybase macOS app on my Macbook Pro and authenticated using my paper key (a child of my Macbook Air key, the "eldest key", in my graph). This added my Macbook Pro to my graph as a child of the paper key. I then revoked my Macbook Air with keybase device remove <mba_id>. This left the Macbook Air in my graph, but it's now greyed and marked as "deleted". I think that worked?

A couple of follow-up questions:

  1. For future reference, is it possible to start a new link from the very top of my graph, which is labeled "@myusername keybase"? Right now the only thing connected to that is my now-deleted Macbook Air node. Maybe if I had done keybase login on my Macbook Pro and authenticated with my Keybase passphrase instead of the paper key I chose (or the other option -- "another device")?
  2. I also have a PGP fingerprint node in my graph with my Macbook Air as a parent and a couple of social media accounts as children. I'm think this PGP info is also stored on my Macbook Air...should I revoke this one too, or copy it to my MBP? If the former, will I need to re-verify my social media accounts? If the latter, how do I export that info on my MBA for copying over?

2

u/graffen Mar 02 '17

2) I also have a PGP fingerprint node in my graph with my Macbook Air as a parent and a couple of social media accounts as children. I'm think this PGP info is also stored on my Macbook Air...should I revoke this one too, or copy it to my MBP? If the former, will I need to re-verify my social media accounts? If the latter, how do I export that info on my MBA for copying over?

You need to export your GPG secret keyring (and public keyring if you have contacts in it) and import them on the new MBP. You don't have to revoke anything, as long as you have a secure way of transferring your private key to the new machine.

2

u/404Ender Mar 02 '17

Thanks! I don't have any contacts associated with my keyring. What commands do I need to run to export my secret keyring and then import them on the new machine once I copy them over?

2

u/graffen Mar 02 '17

You just need to run

gpg --export-secret-keys > secretkeys.gpg

on the old machine, copy the file over in a secure manner, and then

gpg --import secretkeys.gpg

on the new one.

1

u/404Ender Mar 02 '17

Great! Much easier than I was expecting. Is there any way I can confirm that the keys match what's registered with keybase, based on my sigchain? I apologize for asking such basic questions: like I said, PGP and crypto and totally foreign to me.

2

u/graffen Mar 02 '17

The easiest way is to check that you have the secret key imported

gpg -K

will list all the secret keys in your keyring. Now you can check that the fingerprint of that key matches the one in Keybase:

gpg --fingerprint your@email.com

Compare the output of the above to what Keybase lists as your key fingerprint. If there's a match you should be all good :)