Linking to this is evidence that you don't understand the entire value of Keybase.

PGP sucks.

Why? PGP works. (That alone puts it above its supposed alternatives.) It has existed for 30 yrs. That's 30 years of being exploited and patched.

PGP (GnuPG at least) is lightweight. I don't need an Electron dependency or a multi-megabyte chat room in the same application (address space too?) that supposedly keeps my private keys safe.

PGP is spoken by everyone, every programming language, having implementations on even ancient operating systems and architectures. Every email client worth its salt can use PGP. Emacs can decrypt and encrypt GnuPG-encrypted files seamlessly; other editors have plugins to do the same.

It sucks because the UX is so bad that people don’t use it, even when their lives depend on it. [0]

Even when they do use it, it’s easy to mess up.

The biggest flaw though is that in person key signing parties were never a viable or realistic thing for identity verification and web of trust based on that works poorly as a result. The use of multiple signed public social media accounts for identity instead as a way to fix this was Keybase’s main innovation.

For UX, even Snowden couldn’t get Greenwald to set up PGP and after multiple attempts Snowden eventually gave up and tried Laura Poitras with better results, the burden on the user is too high.

[0] https://moxie.org/blog/gpg-and-me/

keyservers don't work as a root of trust. look at all the 'satoshi nakamoto' keys supposedly from 2004

https://pgp.mit.edu/pks/lookup?search=Satoshi+Nakamoto&op=in...

That doesn't tie identity to keys.

Not to mention it's notoriously slow and has been shown to be an insecure method of distributing keys (due to the fact that anybody can upload any key).

Anyone can upload a key to keybase dot com too. You should never trust a key belongs to someone unless you have verified the fingerprint by other means e.g. speaking to them. This is basic security we have known since the 80s. Keybase dot com is a step backwards if anything because of the false sense of security it creates, as if they don't have a giant attack surface.

You don't understand what Keybase does.

The whole point is that you don't just use it to upload a key. You link various verified identifies of yours across the web to your Keybase account so people know the PGP key there is the one of the verified person. It's a way to tie all your verified identifies together.

If someone would manage to compromise a bunch of identities of someone on the internet, and then create a Keybase account with them and then upload a compromised PGP key that would be a problem if you don't verify the key. But that's a bit of a stretch.

In reality: I used keybase for a while. When I allowed a domain to expire and the DNS record disappeared, keybase threw up warning both in cli and their website that my identity verification couldn't be completed. My only problems I ever had with keybase was related to the cloud storage they offer.

My real wish is that keybase supported ssh keys and would provide them as an agent.

You can revoke the DNS signature. I'll assume your keybase account name is the same as on HN.

I do agree on the ssh key feature being nice, and, here's a link: https://keybase.io/blog/keybase-ssh-ca You could also just use the keybase file system to keep ssh keys around.

Please, please, use https://keys.openpgp.org/ instead!

See https://keys.openpgp.org/about for why.

this doesn't even have authenticated encryption