keybase / keybase/client

Require opt-in for Stellar reverse account lookup

Open
#19,721 2 comments 2 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
9.2k
Forks
1.3k
Avg merge
12h 58m
Merged PRs (30d)
56

Description

When I use my default Keybase Stellar wallet to pay in any store outside of Keybase that accepts Stellar, my account id will be logged. This is no big deal, it's how Stellar works.

But this also allows the store or anyone on the internet to identify my Keybase username with all the proofs that this brings, even if they didn't know my Keybase username from the start.
Imagine the profiling and tracking you could do in the real world for advertisements etc.

The Keybase federation server makes this possible by allowing reverse account lookups. I think this should only be enabled for an account if you actively opt in for it.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the federation server's reverse account lookup path and reviewing how account opt-in state could be represented. Done means reverse lookup is unavailable for accounts unless the owner actively enables it, while normal Stellar payments continue to work.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.