UPDATE - 20170228 - Added more stuff I've discovered about KBFS.
A couple of years ago you probably heard about this thing called Keybase launching with a private beta, and it purported itself to be a new form of public key encryption for the masses, blah blah blah, whatever.. but what's this thing good for, exactly? I mean, it was pretty easy to request an invite from the service and either never get one, or eventually receive an e-mail and promptly forget about it. I've been using it off and on for a while, and I recently sat down to really mess …
If you've been following net.news in the past twenty-four to forty-eight hours you heard about what went down at the Chaos Computer Congress yesterday - a group of security researchers figured out how to exploit the flaws in the MD5 hash algorithm to forge CA certificates, thus placing SSL encryption as we know it in jeopardy.
...right? Breaking SSL is bad, yeah?
Like many things in life (and nearly everything in cryptography) it's not that simple or that straightforward. Yes, this is bad, but it's not "go back to punchcards" bad.
