keybase / keybase/keybase-issues
Questions about identifying who to track
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
After reading [docs/tracking](https://keybase.io/docs/tracking) and issue #100 I'm left thinking about how to identify who I should be tracking.
I understand tracking to provide the following:
1. No need to re-verify each site/statement for a user when moving between computers.
2. By viewing other users snapshots I can verify that a user has not changed in a period of time. This is assuming I trust these users are legitimate and their initial verification of the contact was correct.
3. By tracking users myself my snapshots can be used for point 2.
4. By tracking users myself I do not need to trust a 3rd party as in point 2. I have proof that the contact has not changed since my initial verification.
At the top of my Keybase profile it suggests I consider tracking a number of users. As far as I can tell I do not know these users.
Assuming everything so far is correct I'm left questioning if I should I be tracking people I do not know. Should I be independently verifying that they are in control of their accounts and are legitimate users? If yes, is it beneficial to track as many people as possible? If no, should Keybase be suggesting I do track them?
My concern is something like the following:
1. UserA is on Keybase, no one is tracking them.
2. UserA goes offline. (No longer using Keybase related sites, extended holiday, deceased, ect)
3. UserA's is compromised.
4. I join Keybase.
5. Keybase suggests I track UserA.
6. I track UserA without verifying them manually.
7. Other users who trust me may now take my tracking of UserA as proof that 1. UserA is legitimate. And 2. UserA has not been compromised in the days/weeks/months/years since I've been tracking them.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with docs/tracking and issue #100, then review the stated tracking benefits and the UserA compromise scenario. Clarify whether users should independently verify suggested contacts and whether Keybase should suggest tracking unknown users; document the resulting guidance or decision.
Written by the indexing model from the issue text.
Assessment
- Domain
- authentication, security
- Issue type
- Documentation
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100