| Thanks! Yes, we're currently hosting public keys. > Is a self-hosted version of the same possible? The honest answer is, we're not sure yet. It's our strong ambition to make Fluidkeys into an honest, you're-the-customer business, and we aren't sure how we'll license the server. Is self-hosting something your team would be willing to pay for? If so, that might help our business model development! :) > a) Some sort of "paranoid" mode whereby it would show me peer's key (in some form) so that I could, if really wanted, manually verify it. This is a great idea. In that mode, it could output the key fingerprint and prompt before sending. Would that work for you? > b) An option to cache peer keys locally. I assume this is done already and that the local cache lookup is given a priority over the registry search. Correct? Not yet, mostly for simplicity of getting this release shipped. It's currently pretty naive (and I'm not thrilled about it): the key lookup API call is done every time you send a secret. Thinking of fimiliar patterns, perhaps we should take the SSH trust-on-first-use approach, where we record the fingerprint we saw last time, and warn if it changes? That would make it significantly harder for us to subsequently serve you bad keys. Somewhat related, there was a good discussion about how to deal with multiple key discovery mechanisms (e.g. local cache vs server response) at the latest OpenPGP summit. Prioritising local cache (say, your GnuPG keyring) can be quite scary too, if you downloaded a key from the keyservers and subsequently realised it was a fake (and don't use web-of-trust which, well, enough said). Thanks for thinking about this and taking the time to share your ideas. |
Without sugar-coating it - a service like this, with the scope it has now, has * zero * chance of successful monetization. 100% guaranteed.
This is a cosmetic service that aims to address a security need. People who actually need this AND have money to pay for it are in position to explore self-hosted options, which is what they will be looking for in the first place since they DO want proper security. Having a random third party in their security pipeline is not really an option. And people who are not concerned with this part, won't think twice about sending API keys over regular email. In fact, even security-minded people won't have much objection to relaying secrets through their corporate, properly secured email server.
Then, there's an option of productized (self-hosted) version. This is not likely to work either, because the whole thing looks rather trivial and, put bluntly, not worth paying for. Like you aren't likely to pay for hugs, no matter how good they are. Same here - nice to have, but only if free.
All that said, the website is nicely designed and the whole thing is well-presented. It certainly has a potential to be a good demo/promo piece for something larger.