keybase / keybase/keybase-issues
Option to globally disable private key uploads
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
Is there any way to state that Keybase should never accept my private key to be stored on the server? Something like an account-wide option which needs email and/or private key signed confirmation to be changed again?
I really don't want my private key ever to be stored on your servers, not even by issuing the wrong command on the CLI. I know that it's meant to be stored encrypted, but it still is a major problem for me.
If there isn't such an option yet, it would be nice to have it built in. The client should always ask the server if it is allowed to upload the key, before any part of the private key is ever sent over the wire.
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue identifies the CLI/client upload path and a server-side permission check, but names no files or tests. Start by locating where private-key uploads are initiated and how the server could expose an account-wide setting; done means uploads are blocked unless the setting permits them and changes require the requested confirmation.
Written by the indexing model from the issue text.
Assessment
- Domain
- security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100