> So to be clear (1) this writer did in fact have that Stellar Key. And (2) we, Keybase, did not. And (3) they knew they were doing it. I encourage anyone curious to go try it out -- the flow has not changed.
1) I have never seen the private key you claim I "in fact have".
2) I have no way of verifying this information, but I will accept your words on their face.
3) I did not. Your own description of the UX flow says nothing of using the keybase (not Stellar) device key to sign an attestation/proof. That was the unwanted bit, the use of my keybase (again, not Stellar) key to publicly state that I wish to use Stellar.
I'll make a screencap video of the flow if necessary to illustrate how sketchy it is.
The Stellar private key is easy to find in the wallet settings on all of the clients.
Also, I made a test account from scratch to test out the UX flow. Here's what I found (Note, this is the Android version, not iOS).
1) I created a new username and entered the new account on mobile client.
2) I created a password so I could log into the web client.
3) Out of curiosity I went ahead and clicked the wallet tab in the burger menu.
4) I'm then presented with a brief (full screen) 'Welcome' message and have to click a button that says 'Open Your Wallet' to continue.
5) once that button is clicked you are presented with a more lengthy, full screen, disclaimer that takes a minute to read.
Here is what point #3 says
3. CRYPTOCURRENCY ISN'T REALLY ANONYMOUS. When you sign your first of "default" Stellar address into your signature chain on Keybase, you are announcing it publicly as a known address for you. Assume that all of your transactions from that account are public. You can have as many Stellar accounts as you like in Keybase, but whenever you make one your default, that one is then announced as your. Consider that data permanent.
6) I then clicked 'Not now' button. Instead of 'Yes, I agree' button.
7) I log into my web client to see how my new account looks, and in fact, there is no Stellar wallet or address.
Seems to me like you have to explicitly opt into creating a wallet, and the disclaimer is very clear about signing it into your signature chain and announcing it publicly.
So unless the iOS client does not have the same disclaimer and wording, which would surprise me, I'm still not understanding what the problem is. The developer also said they are working on the feature totally remove your default Stellar wallet, so I imagine in the near future you can delete it.
1) I have never seen the private key you claim I "in fact have".
2) I have no way of verifying this information, but I will accept your words on their face.
3) I did not. Your own description of the UX flow says nothing of using the keybase (not Stellar) device key to sign an attestation/proof. That was the unwanted bit, the use of my keybase (again, not Stellar) key to publicly state that I wish to use Stellar.
I'll make a screencap video of the flow if necessary to illustrate how sketchy it is.