Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Yes. That they have a large impact does not change the fact that not I nor anyone in my close circle uses it for that. It has been relegated to a specialized domain and use case. I have no use for maintaining a signing key. All the communications I need to secure and verify identity use a different technology for it. The fact that some tools I run might use it in the background is entirely abstracted away for me and they could get swapped by something else without me once noticing.

My point still stands.



If you write open source code others rely on, or have any online identity that could be used for harm if stolen, it is irresponsible to not have a well published public identity signing key that cryptographically ties together your online presences to make you hard to impersonate. A key used to sign commits, binaries, code reviews, emails, or anything else of public value you produce.

If you do not do anything of consequence outside of corporate walls and are just a passive consumer of technology, then you probably do not need one.

The fact you have keybase in your profile indicates to me that you at least at one point mildly cared about having a cryptographic identity. Keybase just happened to have been a wildly broken implementation. Keyoxide is the path today.


Except that I do all of those things and I don't care about it at all nor does the absence affect me in any way. Keybase was a nifty chat.


Fair enough. If you care about your identity so little, I expect when your personal domain ever expires you will not mind if I buy it and impersonate you? It would be valuable for my supply chain attack education work.


Have at it. It's not really a part of my identity. Nor has it ever been protected by GPG.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: