keybase / keybase/keybase-issues

Verifying a message should offer a description of what it's doing

Open
#248 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
899
Forks
40
PR merge metrics
No merged PRs in 30d

Description

I tried verifying a message sent by me by email using mutt. It carried a `signature.asc` that confirmed that I sent it, so it wasn't ascii-armored (I don't usually sign emails that way, because it is visually annoying).

The first thing I tried was pasting the message into the verify box. This obviously didn't work, because there was no signature to check it against.

> Error: no header found

No header found? What - ok, obviously it's expecting a signature object or something. So I copy the signature text into the page, which is largely useless - it might confirm that I signed _something_, but wouldn't prove anything about the _content_ that I signed. Regardless, I figured it might work -

> Error: Unknown message type: SIGNATURE

Hm. Ok. Maybe it only works on ascii-armored input. I don't know, because I don't have ascii-armored text sitting around, and I don't have any idea of what the verify function actually _does_. All the help text says is:

> ## Verify in the terminal
>
> Browser crypto can be scary. Do you have an evil extension installed? We can't tell. Further, have we been tortured into serving you custom, targeted JavaScript? Hopefully you're not that important.
>
> So: only use this page if (1) you feel your browser is clean and (2) a life doesn't depend on it.
>
> Alternatively, the keybase program is open source and uses both GPG + the Keybase identity proofs API. It's great.

Sure. Browser crypto can be scary. But it's not getting any less scary when I have absolutely no clue what the browser crypto even does.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at the website's Verify page and review the existing “Verify in the terminal” help text alongside the reported message and signature.asc inputs. Reproduce the “no header found” and “Unknown message type: SIGNATURE” cases, then clarify the accepted input and what verification checks so the page's behavior is understandable.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
cryptography, security, web-dev
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.