keybase / keybase/keybase-issues

Questions about identifying who to track

Open
#1,301 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

After reading [docs/tracking](https://keybase.io/docs/tracking) and issue #100 I'm left thinking about how to identify who I should be tracking.

I understand tracking to provide the following:
1. No need to re-verify each site/statement for a user when moving between computers.
2. By viewing other users snapshots I can verify that a user has not changed in a period of time. This is assuming I trust these users are legitimate and their initial verification of the contact was correct.
3. By tracking users myself my snapshots can be used for point 2.
4. By tracking users myself I do not need to trust a 3rd party as in point 2. I have proof that the contact has not changed since my initial verification.

At the top of my Keybase profile it suggests I consider tracking a number of users. As far as I can tell I do not know these users.

Assuming everything so far is correct I'm left questioning if I should I be tracking people I do not know. Should I be independently verifying that they are in control of their accounts and are legitimate users? If yes, is it beneficial to track as many people as possible? If no, should Keybase be suggesting I do track them?

My concern is something like the following:
1. UserA is on Keybase, no one is tracking them.
2. UserA goes offline. (No longer using Keybase related sites, extended holiday, deceased, ect)
3. UserA's is compromised.
4. I join Keybase.
5. Keybase suggests I track UserA.
6. I track UserA without verifying them manually.
7. Other users who trust me may now take my tracking of UserA as proof that 1. UserA is legitimate. And 2. UserA has not been compromised in the days/weeks/months/years since I've been tracking them.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with docs/tracking and issue #100, then review the stated tracking benefits and the UserA compromise scenario. Clarify whether users should independently verify suggested contacts and whether Keybase should suggest tracking unknown users; document the resulting guidance or decision.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, security
Issue type
Documentation
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.