Social Discovery Network

[CMCDragonkai]

Related to #32 but instead focused on the human network instead of the machine network. Keybase now offers the ability for arbitrary services to become to integrate social identity proof to keybase: https://keybase.io/docs/proof_integration_guide

Other social networks may also be possible.

Also relevant discussion: https://news.ycombinator.com/item?id=19639297

[CMCDragonkai]

Keynodes have unique digital identities. This makes sense from a programming infrastructure point of view, but we also want to make it easy for humans to share secrets with other humans. To do this, humans must then be able to find out the relationship between keynodes and other humans.

We can take inspiration from keybase to do this. Keybase allows one to federate discrete identities into 1 common identity. So you now have a cryptographic relationship between your Github account, Facebook account and Twitter account.

Therefore to represent a relationship between keynodes and a human. A human must have some unique identity (could be a GPG key, but it also be a social proof cluster, really it can be anything..., trust starts from somewhere), and then all the keynodes are in a crypto-cluster representing that relationship with the human identity.

To start, we can piggyback of keybase to do this, especially with the new proof integration feature.

This makes Polykey a hybrid architecture, in one sense centralised by relying on centralised social proof, but also decentralised core. However I believe it is still decentralised, as the social proof providers can change over time. And we can follow keybase proof integration guide to eventually allowing any social proof providers to integrate into Polykey.

It is important to also consider when the relationship changes between the human and the keynode. Such as in the case when transferring keynode to another human (that shouldn't really happen). But also if a keynode is compromised.

[robert-cronin]

I think direct integration for signup/login is possible as well as for peer discovery.

For peer discovery, its quite simple to use keybase lookup api. We can expose a function like findSocialUser that takes a handle like robert-cronin as well as a service like github and then queries the keybase network for the pubKey attached to that socially proven user. This is linking digital identities to social identities.

Direct integration can go further because keybase allows one to signup and login all via a HTTP API, once you are authenticated and logged in, you can fetch the keys needed to initialise PolyKey and then you have a PolyKey node directly linked to a socially proven human identity which solves the key sharing bootstrapping problem.

Keybase integration for peer discovery will be implemented in the upcoming PR #40. After that, the user experience becomes quite smooth: user asks polykey to find robert-cronin, and then if the user's keynode is running on the same local area network (LAN), multicast peer discovery will find it and exchange peer information and vault sharing can proceed from there.

Integration for signup and login will have to be done on a later PR, there are still some things to figure out, such as if keybase actually releases the users private key over https or whether or not we should have a derived sub key for polykey operations and how to do that.

[robert-cronin]

Closing on account of migration to gitlab