So how exactly does it open a truly secure chat with someone else? If it is encrypting messages, then the recipient would have to have my public key to decrypt the message, right?
But if keybase is sending the recipient my public key, then doesn't keybase have the ability to decrypt my messages, too? And if keybase can do that, than can't everyone else that is watching the public key go over the wire decrypt my messages, too?
It seems like this is really only good for proving that the sender of a message is who they say they are, but not really good for privacy.
Please correct me if I'm wrong. How is this supposed to work?
When you send a message, you encrypt it with their public key, so that only they can decrypt it. Additionally, you sign the message with your private key, so the person who receives the message can verify that you signed it, by using your public key.
This is the general idea of how public/private key crypto works. The actual Keybase implementation is a bit more complicated because a person doesn't have exactly one public/private keypair, but rather keys for each device.
You need the private key for decryption. Private keys sit locally on each device and don't go anywhere. Messages are encrypted with all public keys of the recipient and yourself, so every party can read the conversation on any device.
But if keybase is sending the recipient my public key, then doesn't keybase have the ability to decrypt my messages, too? And if keybase can do that, than can't everyone else that is watching the public key go over the wire decrypt my messages, too?
It seems like this is really only good for proving that the sender of a message is who they say they are, but not really good for privacy.
Please correct me if I'm wrong. How is this supposed to work?