docs: Update keychain info

[marcus-pousette]

No description provided.

[maschad]

Thanks for updating this! We will soon have doc verification to catch these types of issues #1505. I have made some suggestions, almost there.

[marcus-pousette]

I am not sure about the pass config, it does not seem to be used for exporting and importing peerIds ? I wonder whether the description would be misleading in this case, when I think about it now.

[maschad]

I am not sure about the pass config, it does not seem to be used for exporting and importing peerIds ? I wonder whether the description would be misleading in this case, when I think about it now.

I would say the key management is separate from the exporting of peerIds associated with those keys. A password isn't required because the key isn't being exported in a format that is typically password-protected as Peer IDs are derived from public keys.

[marcus-pousette]

I would say the key management is separate from the exporting of peerIds associated with those keys. A password isn't required because the key isn't being exported in a format that is typically password-protected as Peer IDs are derived from public keys.

I see. Well I got initially confused as I assumed the password would make anything I import to the keychain, encrypted at rest with the password provided in the config. But there is a different case for these PeerIds I guess then.

But I am ok with how it is now, if you are ok. I guess the documentation can improve further more in the future iteratively.

Would it make sense that I create a separate issue for safely encrypting PeerIds at rest? It is kind of important if you want to protect yourself against supply chain attacks, especially in the browser.

[maschad]

Would it make sense that I create a separate issue for safely encrypting PeerIds at rest? It is kind of important if you want to protect yourself against supply chain attacks, especially in the browser.

This is a separate issue so feel free to open one, but I am not sure that encrypting PeerIds alone would prevent a supply chain attack in the browser, especially if the public key is known. I would suspect that preventing such an attack would require a more comprehensive approach that addresses the whole networking stack.