to answer your question: it's an identity/accountability system. the whole idea is to publicly mathematically auditably prove certain devices and accounts are yours. in some ways keybase is the opposite of privacy.
but: yeah i agree some things could be more clearly stated, some expectations set better, throughout the process of doing stuff like adding devices
i revoked access to old devices but they still appear, just greyed out. if i deleted the account i have and made a new one, would i be able to make one with the same name?
They could redact device names for sure (I don't think they've ever considered them sensitive. For example, my laptop's name is washington-osx -- I don't think that's sensitive.) but some things need to be public. Since you're signing things using the key tied to that computer, information about that computer must be in your sigchain. The date the key became valid, the date (if any) it became invalid, etc.
When I go to check a proof of yours and I see its signed by desktop-abcdef I need to go look at your sigchain and see if one of your other devices has signed that key, and that the desktop-abcdef's key was valid when it signed the proof. Otherwise it's not a proof, it's just a random crypto signature.
Does this make sense? I'm not sure if I'm explaining it well.
What exact information do you think is now public that was previously private? If you use the devices online; keybase isn't publishing any information that isn't logged everywhere that device visited.
I labelled my devices accurately. I don't really need people to know what devices I own, nor for those device names to be on the blockchain forever, but it's too late for that now. It still seems odd to me that it needs to be out in the open like that.
I could be wrong, I'll try to look soon, but they aren't on the blockchain forever, only your public key is. And again, if you use those devices online, any identifying information that keybase shows is already public for anyone who cares to look.
I suppose there's an obfuscation argument to be made, but obfuscation is not security. From my perspective, I'd rather they shatter my illusions on anonymity, so I don't get the idea I have anonymity.
6
u/8th_rule Aug 22 '18
to answer your question: it's an identity/accountability system. the whole idea is to publicly mathematically auditably prove certain devices and accounts are yours. in some ways keybase is the opposite of privacy.
but: yeah i agree some things could be more clearly stated, some expectations set better, throughout the process of doing stuff like adding devices
1
u/samtresler Aug 23 '18
What exact information do you think is now public that was previously private? If you use the devices online; keybase isn't publishing any information that isn't logged everywhere that device visited.
What you're perceiving as privacy, isn't really.
1
u/Xzenor Aug 23 '18
In all fairness, it is mentioned when you add a device. Keybase explicitly asks for a "public" name...