search

keybase / keybase-issues

A single repo for managing publicly recognized issues with the keybase client, installer, and website.
902 stars 37 forks source link

feature request: switch from PGP to Saltpack in web #3935

Open edmundlaugasson opened 4 years ago

edmundlaugasson commented 4 years ago

Hereby would propose to use Saltpack in web when offering encryption, decryption - just like in app. Currently when non-Keybase user sending message via web, it comes in PGP format that cannot be decrypted in web when not hosting private key (considered not secure). Especially in case of smart device there is no PGP key usually available even in command-line but only Keybase. So, using Saltpack format for encryption could allow decrypt then regardless what to use. As you preach also at https://keybase.io/blog/crypto - Saltpack is a general format. We'd love to see its wide adoption - so, please, adopt it!

MattRudy commented 3 years ago

Seconded, and following this issue. Web App currently encrypts PGP, and decrypts ONLY if you upload private key (not recommended) Desktop App currently encrypts/decrypts Saltpack CLI encrypts/decrypts both formats, but there's a barrier to entry here.

I strongly request moving to Saltpack format for encrypt/decrypt in the Web App, as this will reduce a lot of friction I've seen in getting less-technical users to be more secure!

The ideal-path we want third-parties and internal users to follow looks like this:

  1. Internal User shares a link to their Keybase encryption page such as https://keybase.io/encrypt#mrudy
  2. Third-party individual visits https://keybase.io/encrypt#mrudy to encrypt with Saltpack without requiring Keybase registration (more exposure to Keybase and less friction for new users - good for everyone!)
  3. Third-party individual sends Saltpack to Internal User via email or other method
  4. Internal User uses the Desktop App or Web App to decrypt the Saltpack (lower technical barrier to entry for internal adoption when compared to PGP decryption by CLI)

Hopefully this is a priority for future development - the two different message formats being used in the Web App and Desktop App is a barrier for wider adoption right now.