Facebook PGP Authentication

I opened a new issue to keep discussion out of #518 for the sanity of those who subscribed to the issue.

[Original Discussion]

I just tested this process;

Once you enter your public key, Facebook generates an encrypted email and sends it to you.

This is correct. So to even establish a link between your profile and your public key you have to click an encrypted link held within the message that Facebook sends you -- establishing that you have possession of the private key.

This could be viable if there's a way to programatically check for a user's public key within the graph API, for example. However, at that point you're really trusting that Facebook is doing due diligence--which is not ideal at all. I think there has to be a medium which includes a signed statement somewhere. Perhaps in the profile fields? If that's completed securing Facebook accounts would probably be one of the strongest proofs we have. You have to establish your identity to Facebook (by having the private key) and then using the same key pair, sign a prepared statement for Keybase.

Start by reading the original discussion in issue #518 and the references to Facebook's Graph API, encrypted email, public keys, and signed statements. This issue does not define an implementation scope or completion criterion, so a concrete definition of done would need to be established before work begins.