Refusing to verify myself: I am liz on

Keybase seeks to be a "public directory of publicly auditable public keys" with simpler usernames than PGP and verified account linking to popular sites such as Twitter and GitHub. This is awesome because "PGP for humans" is long overdue and because I snatched up the namespace liz.

Linking my verified public PGP key with Keybase was easy enough by using gpg on a trusted machine and copying into their web client. I associated my PGP key with fingerprint 89CB 0766 5EB4 2515 EE7F 3FAA E0B9 3B4A 4E8E A664 to the username liz, but this doesn't establish much in the way of my identity.

PGP's standard for establishing identity, the web of trust, is complicated and non-intuitive - I trust my friend Nelson's key, Nelson trusts Anders's key, Anders trusts Alex's key, and Alex trusts Ceres's key, so naturally, I should believe 9D06 536F FD85 F747 8846 CAAD 7688 4EEA 6E6D 80F4 is Ceres. Instead of relying on trusting a chain of signatures, the bread and butter of Keybase's directory is using accounts on popular and personal sites to establish identity. While this is arguably insecure because such accounts can be compromised (though so can PGP keys), I already have mappings from people to those accounts and am inclined to believe that their keys belong to them after they've established those accounts on Keybase.

Unfortunately, I couldn't find a way to securely establish @redroselet, lizdenys on GitHub, or as liz. Uploading a client-encrypted copy of my private key was right out - if a malicious attacker com­pro­mis­es Keybase's soft­ware, they'll have access to my key and could get my passphrase the next time I type it. The only other option is the Keybase command line client, which is already more appealing to me because I love living my life inside a terminal (really).

The Keybase command line client installer depends on npm. The machine I trust with my PGP keys is running Ubuntu 12.04.4 LTS (Precise Pangolin), which is supported until October 2017. The version of node in apt is 0.6.12, which is older than the minimum required version to install keybase. This is unfortunate because apt-get authenticates packages as an entity I trust because I trust my operating system. If I install a later version of node, I either need to trust another party, whom I may not be able to easily verify as trustworthy, or build npm from source myself, which requires that I understand how the node source code and a packaging system I've never seen before works to my satisfaction. Beyond that, I couldn't easily figure out if npm authenticates packages. It doesn't seem particularly safe for me to trust my valuable PGP keys to this system.

Hash: SHA1

So I'm liz on, and I'm refusing to verify myself.

Version: GnuPG v1.4.11 (GNU/Linux)