PGP invented that, and if you use actual PGP it will tell you your key fingerprint in English words, using https://en.wikipedia.org/wiki/PGP_word_list . Someone submitted a patch to GPG to do the same, but it got rejected for being non-localisable and bikeshedded to death.
Oh for fsck sake. Do they understand how much of a hassle it is currently?
It seems there's already Keybase like solution using OpenPGP only (no centralized infrastructure needed): https://keyoxide.org/
If you have any suggestions as to which E2E (group) messaging+fileshare+git platform I could use as a replacement for Keybase I'm all ears.
As far as I've seen the proof integration is used only for Mastodon insurances and Keyoxide supports all of them by default: no need to ask for permission, no weird conditions to enter like, instance has to be bigger than N people.
I see this as a way to control who gets into Keybase. A perfect example of centralized control. The idea of programmable proofs looks good though.
> If you have any suggestions as to which E2E (group) messaging+fileshare+git platform I could use as a replacement for Keybase I'm all ears.
Sadly I won't help you with that. There are a number of services that want to eat Keybase's cake now but neither of them hits all points on my scale. So I'm using mostly several different services to get a semblance of the Keybase experience.
Just Mastodon a very narrow view of what could be implemented though. I saw alpha implementation for Discourse as well, before Zoom acquired them.
> no need to ask for permission, no weird conditions to enter like, instance has to be bigger than N people.
Yep that sounds reasonable, as long as we're not going to end up with a DoS because of too many proofs.
maybe BIP39? (afaik it's used for paper keys in bitcoin-adjacent things)
https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi...
The former being something entire countries are struggling with, how do we know the correct person is actually receiving the content, how can I be sure? WoT, PKI, whatever. You fail this, the rest is in practice IMHO less than useless. There's things like https://keybase.io that did try to solve this to a reasonable extent, PGP but more modern. It looked hopeful, but Zoom seems to only keep it on life support. Maybe someone will continue, anyways, I digress.
The second aspect is IMHO what determines how usable it is for a single person over long period of time. Maintaining backups of minisig keys, chat keys (or even not being able to do so), file encryption keys is difficult to say the least. It's unlikely you'll even be able to use a HSM for your secrets like a YubiKey. The same negatives listed against PGP apply to other systems suggested in the article. For example how do I communicate to people sending me encrypted messages that I lost and migrated to a new key/subkey? It's a very hairy problem.
(This reminds me, does anyone here know how to get PGP paper keys that use only english words e.g. "brunch pineapple house crow ..."? And does anyone know why we aren't using english words to compare PGP key IDs yet?)
I agree with a lot what the article lists, but the alternatives suggested really aren't compelling when looking at the actual problem. Judging based on the market share, I think I'm not the only one that thinks so.