<story><title>Refusing to verify myself: I am liz on Keybase.io</title><url>http://blog.lizdenys.com/2014/03/31/refusing-to-verify-myself/</url></story><parent_chain><item><author>kylec</author><text>I like the idea of Keybase.io, but I would prefer to use it in a way in which I don&amp;#x27;t have to trust them at all. As it stands, you need to install their command-line tool and have it directly manage your GPG keychain. For that, I&amp;#x27;d prefer to have a platform-neutral tool that&amp;#x27;s been independently audited and managed by my OS&amp;#x27;s package manager rather than their keybase-installer tool which seems to want to update very frequently with who-knows-what changes.</text></item></parent_chain><comment><author>malgorithms</author><text>While we like being #1 on Hacker News, bad (good?!) timing is what earned us this spot.&lt;p&gt;It will be the case very soon that you can push your key to Keybase and prove all your identities, without ever installing the client the OP dislikes. Technically, you can already, we just need to put together very explicit instructions and documentation that&amp;#x27;s different for each kind of proof. By ugly necessity, what it takes to prove yourself on twitter is different from github is different from DNS, etc. Documenting the API was our priority coming into this week.&lt;p&gt;Later this week the site will have very specific instructions on how to prove your identities (even the complicated ones) simply from your shell plus GPG.&lt;p&gt;Then those who care can verify all those proofs with a script, in a language of their choice. No Node or NPM needed for any of it.&lt;p&gt;There was some discussion below about &amp;quot;trusting&amp;quot; the Keybase server&amp;#x27;s definition of the public key that comes back. The goal here is to remove that trust. Software of your choice can download a Keybase user&amp;#x27;s keys, the links to their proofs.</text></comment>
<story><title>Refusing to verify myself: I am liz on Keybase.io</title><url>http://blog.lizdenys.com/2014/03/31/refusing-to-verify-myself/</url></story><parent_chain><item><author>kylec</author><text>I like the idea of Keybase.io, but I would prefer to use it in a way in which I don&amp;#x27;t have to trust them at all. As it stands, you need to install their command-line tool and have it directly manage your GPG keychain. For that, I&amp;#x27;d prefer to have a platform-neutral tool that&amp;#x27;s been independently audited and managed by my OS&amp;#x27;s package manager rather than their keybase-installer tool which seems to want to update very frequently with who-knows-what changes.</text></item></parent_chain><comment><author>epaulson</author><text>I also like the idea of Keybase.io, though I wish it was based on something a little more decentralized. The unfortunately-named WebFist looks cool:&lt;p&gt;&lt;a href=&quot;http://www.onebigfluke.com/2013/06/bootstrapping-webfinger-with-webfist.html&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.onebigfluke.com&amp;#x2F;2013&amp;#x2F;06&amp;#x2F;bootstrapping-webfinger-w...&lt;/a&gt;</text></comment>