search

keybase / keybase-issues

A single repo for managing publicly recognized issues with the keybase client, installer, and website.
902 stars 37 forks source link

Use actual name when importing public key into GPG keyring #230

Open npdoty opened 10 years ago

npdoty commented 10 years ago

When I keybase track a user, their public key is automatically added to my GPG keyring. (I love this feature, by the way.) But in the Name field, instead of the full name associated with that account on Keybase, instead I see: "keybase.io/keybase_username". (This might just be with users who created their keys via keybase.io rather than having generated them separately, I'm not sure.)

I don't think it needs to be namespaced this way, does it? I'd rather that had the real name as entered by the user into their account, and the comment field can be used to indicate that keybase.io was the client. (Also, could it use the email address they like/use instead of username@keybase.io? I know that's related to #105, but I'd also hope the default would be the actual email address rather than a forwarding account.)

vilhalmer commented 10 years ago

+1. It would be nice if Keybase asked for name + email first, so that they could be properly incorporated into the newly-generated key.

gwillen commented 10 years ago

For keys that were generated using keybase, it makes sense for the userid to feature this prominently -- it's really a different kind of beast from a key that a user has generated using gpg directly on their own private machine, and I imagine some gpg users might object to silently mixing keybase-generated keys in with gpg-generated keys.

A comment might be enough, though.

vilhalmer commented 10 years ago

That's fair. Alternatively, it could be something like "Full Name (keybase.io/user)". This would still sort in with other names in the keyring, but make it pretty obvious that it was generated here. A comment would be preferred, though, I think.

tildelowengrimm commented 10 years ago

Why is it important for a key generated on the Keybase website to have a comment to that effect?

gwillen commented 10 years ago

@flamsmark Well, the only people likely to closely-inspect the comment are old-school GPG users. And many such people unhappy with the idea of doing cryptography in potentially-untrustworthy Javascript code, and probably want the option not to trust such a key.

(And, I am additionally assuming, because it would be unproductive for Keybase to get in a fight with those people.)

tildelowengrimm commented 10 years ago

I think that old-school GPG users are more likely to get grumpy about key comments.