keybase / keybase/keybase-issues
Verifying a message should offer a description of what it's doing
- Dominant language
- No language data
- Stars
- 899
- Forks
- 40
- PR merge metrics
- No merged PRs in 30d
Description
I tried verifying a message sent by me by email using mutt. It carried a `signature.asc` that confirmed that I sent it, so it wasn't ascii-armored (I don't usually sign emails that way, because it is visually annoying).
The first thing I tried was pasting the message into the verify box. This obviously didn't work, because there was no signature to check it against.
> Error: no header found
No header found? What - ok, obviously it's expecting a signature object or something. So I copy the signature text into the page, which is largely useless - it might confirm that I signed _something_, but wouldn't prove anything about the _content_ that I signed. Regardless, I figured it might work -
> Error: Unknown message type: SIGNATURE
Hm. Ok. Maybe it only works on ascii-armored input. I don't know, because I don't have ascii-armored text sitting around, and I don't have any idea of what the verify function actually _does_. All the help text says is:
> ## Verify in the terminal
>
> Browser crypto can be scary. Do you have an evil extension installed? We can't tell. Further, have we been tortured into serving you custom, targeted JavaScript? Hopefully you're not that important.
>
> So: only use this page if (1) you feel your browser is clean and (2) a life doesn't depend on it.
>
> Alternatively, the keybase program is open source and uses both GPG + the Keybase identity proofs API. It's great.
Sure. Browser crypto can be scary. But it's not getting any less scary when I have absolutely no clue what the browser crypto even does.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at the website's Verify page and review the existing “Verify in the terminal” help text alongside the reported message and signature.asc inputs. Reproduce the “no header found” and “Unknown message type: SIGNATURE” cases, then clarify the accepted input and what verification checks so the page's behavior is understandable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- cryptography, security, web-dev
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100