|
|
|
|
|
by lucb1e
2391 days ago
|
|
It depends. If you use the official app, then it's sort-of end to end encryption but with an asterisk that you have to trust their servers not to mess with you from the beginning. They can't start intercepting at will, though, they have to target you from the beginning, and if the server did that with everyone, odds are that someone caught on by now. So it's probably fine. If you use a client where you can view the crypto keys for out of band verification (I think the command line client can do this, but it's awful to use as daily driver), then it is actually end to end encrypted, and you should only have to do this once. Verifying your key in the command line client and then using the app will not do, since the server can selectively lie to your app. I'm not saying it's likely, but when speaking of sending keys to the kingdom through it, it can be a reasonable precaution to verify crypto keys for the client you're using, depending on your company and threat model (if you're in the USA, well, so is Keybase so that's less of an issue than when you're in Iran and you think Keybase is magically end to end encrypted with no verification needed, as their docs suggest). Since all devices connected to your account receive a copy of the data, it doesn't matter which device you use to send or receive the secret keys. |
|