keybase / keybase/keybase-issues
Have `keybase prove` optionally provide instructions
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
[I'd be surprised if this isn't already an issue, but I can't find it under any search terms I can think of]
The command `keybase prove web example.org` requests the passphrase for a secret key, presumably in order to produce the bit of text which is to be made available at `example.org/.well-known/keybase.txt`. However I'm averse to putting in my passphrase there – can I do it by hand instead?
The point, of course, is that I'm obliged in principle to suspect the keybase application of all sorts of malevolence, and that it's actually about to steal my secret key and passphrase and upload them to the keybase underground lair (the one inside the volcano, with the persian cats and piranhas and stuff). Instead, I want to do the signing by hand, with instructions that keybase provides. The keybase developers have suggested (in for example issue #794) that 'An identity proof [...] can both be generated in GPG with commands we show people how to write.'
So the issue is:
- are such instructions available anywhere (I can't find them, so the issue may just be one of making these more visible); or alternatively
- would it be possible to have `keybase prove` emit such instructions.
For the latter, I can imagine a mode
```
% keybase prove --instructions web example.org
```
which simply emits a proof text and says 'sign this, using `gpg ...`, and put it at XXX', and analogously for the other proof methods.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the `keybase prove` command and compare the existing web and other proof methods described in this issue. Determine whether manual-signing instructions already exist; done means documenting them or adding an instructions mode that emits the proof text, signing guidance, and destination.
Written by the indexing model from the issue text.
Assessment
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100