search

keybase / keybase-issues

A single repo for managing publicly recognized issues with the keybase client, installer, and website.
902 stars 37 forks source link

Paperkey command should give option to print a QR code, so you can easily put in wallet #2051

Open ghost opened 8 years ago

ghost commented 8 years ago

Keybase's paperkey command is pretty insistent that you put it in your wallet. To make this more convenient, it should ask the user if they want to print a small QR code version (maybe the size of a business card), which can quickly and easily be placed in your wallet.

RichJeanes commented 8 years ago

I don't really see how that would be useful. Typically QR codes are used for getting info to mobile devices, but when are you going to be provisioning a mobile device without a previously provisioned device around? Also, on mobile devices, a QR code would only be marginally easier than typing in a dozen short words (which can actually be autocompleted since the pool of valid words is relatively small, a la Mycelium wallet backups for Android). And, yes, you could theoretically use it on desktop or laptop computers, but there's no guarantee that they will have a webcam to capture the code with. Not to mention the added effort of supporting camera access on Windows + MacOS + *nix. And since you can't guarantee that you'll have a camera, you'll still be carrying the word list around, too. And how many times to you think you'll actually need to use your paper key that this would be a worthwhile time/effort saver? To me, it seems like this would be a lot of added work for a very small benefit in a small number of cases.

smoyer64 commented 8 years ago

There are security implications to printing your paper key - whether as a QR code or just as output. In fact, I was happy to see the keybase paperkey command insist that you "write it down". Many modern printers have hard drives or other intrinsic storage. If your printer is networked (via Ethernet or wi-fi) or your printer is shared via USB, your paper key might be available to the world. I've heard stories involving almost every brand of printer we've used, so I also don't print out documents that contain my personal information (SSN, credit card numbers, etc). Here's a fluffy story but if you dig you'll find plenty of technical "how-tos" - http://www.nbcnews.com/business/consumer/exclusive-millions-printers-open-devastating-hack-attack-researchers-say-f118851

sebastiannielsen commented 8 years ago

@smoyer64 : If you read the article you quoted, you will have found: "printers behind a firewall would be safe." Thus, its a non-issue as long as you have something in front that protects the printer from hacking. Its enough with a NAT router.

If your computer, which you display the paperkey on, is infected with malicious software, your'e "owned", regardless of if you print or write the paperkey down.