5 ms·

An Advanced Intro to GnuPG

177 points by sr2 9y ago

confounded 9y ago
GPG is still incredibly useful for me, if only for SSH keys on a YubiKey smart card. I need to get better at code signing on FOSS projects.
- hdhzy 9y ago
  Pass [0] is also incredibly useful. Also Facebook and many Bitcoin exchanges can PGP encrypt sent emails. [0]: https://www.passwordstore.org/ https://www.passwordstore.org/
- adisbladis 9y ago
  Actually it's very easy if you use git, just 2 lines of config. git config --global user.signingkey <your_pub_here> git config --global commit.gpgsign true
  - brians 9y ago
    That's not the hard part. The hard part is getting keys moved around, expiry updated, subkeys handled—maybe having one key on the Yubikey helps with this, but I think sublet expiration is still going to be a problem.
    - confounded 9y ago
      Yup. By signing releases / commits with a particular key you're committing to maintaining possession and security of the key over the long term. For someone that loses their house key about 3 times a year, this is a big deal!
amingilani 9y ago
I still don't understand the state of hardware tokens. Everyone hates Yubikey, but the closest alternative available is Nitrokey which doesn't even come close to the form factor, or support U2F in their most expensive key option. Now I learn there's something called GnuK but Google leads me to an obscure doc on building it yourself. Until there are better options out there, I guess I'll stick to my Yubikey NEO
- adisbladis 9y ago
  This is not my experience at all.. Most people I talk to about this loves their Yubikeys including myself. I guess they have gotten a lot of flack for not being fully open source but in my experience most people are OK with this.
  - amingilani 9y ago
    That's what I meant. From what I can recall on HN articles in the past, they hate them because it's closed source. Even this article says they're bad.
    - j_s 9y ago
      Yubikey originally supported an open source applet that ran on a proprietary runtime. A positive for this partially open source approach was that a serious bug was found in the applet (PIN bypass) and they had to do a recall. They have since switched to 100% proprietary. https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory... I think they catch more flack because of the switch than they would have if they had been completely proprietary the entire time! (Even though the original open source applet couldn't be trusted completely since it ran on a proprietary runtime, the same way many do not trust open source Android software on phones due to proprietary cellular hardware.) https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
- simias 9y ago
  I have a yubikey 4 and a nitrokey and I use the former on a daily basis (and the nitrokey as a backup). The yubikey is faster and feels sturdier without needing a cap. That being said I think the main objection to the yubikey is that they're using closed source software on the key. I'm not sure I really get the objection to be honest, in the end even if the soft is open source you have to trust them to actually flash that software on the key and not inserting hardware backdoors in the first place. I highly recommend to every power user out there to get a GnuPG smartcard. It's convenient, secure, you can use it to sign and/or encrypt anything (email, files, passwords, git commits...), you can use it as an SSH key through GPG agent etc... It's well worth the ~50 euros it costs for the peace of mind it provides. Hopefully it'll make PGP more popular and make it possible to actually send encrypted emails. I can't remember the last time I've received one myself...
ghostDancer 9y ago
GnuPG Fundraising Rally https://gnupg.org/donate/ https://gnupg.org/donate/
Xophmeister 9y ago
Is GPGME, mentioned in this video, now libgcrypt, or is that something different?
0xADADA 9y ago
I thought GnuPG was so last year?
LordKano 9y ago
I'd like to see more of this covered in beginning legal CS and IS education.

177 points by sr2 9y ago

GPG is still incredibly useful for me, if only for SSH keys on a YubiKey smart card. I need to get better at code signing on FOSS projects.

hdhzy 9y ago
Pass [0] is also incredibly useful. Also Facebook and many Bitcoin exchanges can PGP encrypt sent emails. [0]: https://www.passwordstore.org/ https://www.passwordstore.org/
adisbladis 9y ago
Actually it's very easy if you use git, just 2 lines of config. git config --global user.signingkey <your_pub_here> git config --global commit.gpgsign true
- brians 9y ago
  That's not the hard part. The hard part is getting keys moved around, expiry updated, subkeys handled—maybe having one key on the Yubikey helps with this, but I think sublet expiration is still going to be a problem.
  - confounded 9y ago
    Yup. By signing releases / commits with a particular key you're committing to maintaining possession and security of the key over the long term. For someone that loses their house key about 3 times a year, this is a big deal!

amingilani 9y ago

I still don't understand the state of hardware tokens. Everyone hates Yubikey, but the closest alternative available is Nitrokey which doesn't even come close to the form factor, or support U2F in their most expensive key option. Now I learn there's something called GnuK but Google leads me to an obscure doc on building it yourself. Until there are better options out there, I guess I'll stick to my Yubikey NEO

adisbladis 9y ago
This is not my experience at all.. Most people I talk to about this loves their Yubikeys including myself. I guess they have gotten a lot of flack for not being fully open source but in my experience most people are OK with this.
- amingilani 9y ago
  That's what I meant. From what I can recall on HN articles in the past, they hate them because it's closed source. Even this article says they're bad.
  - j_s 9y ago
    Yubikey originally supported an open source applet that ran on a proprietary runtime. A positive for this partially open source approach was that a serious bug was found in the applet (PIN bypass) and they had to do a recall. They have since switched to 100% proprietary. https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory%202015-04-14.html https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory... I think they catch more flack because of the switch than they would have if they had been completely proprietary the entire time! (Even though the original open source applet couldn't be trusted completely since it ran on a proprietary runtime, the same way many do not trust open source Android software on phones due to proprietary cellular hardware.) https://www.yubico.com/2016/05/secure-hardware-vs-open-source/ https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...
simias 9y ago
I have a yubikey 4 and a nitrokey and I use the former on a daily basis (and the nitrokey as a backup). The yubikey is faster and feels sturdier without needing a cap. That being said I think the main objection to the yubikey is that they're using closed source software on the key. I'm not sure I really get the objection to be honest, in the end even if the soft is open source you have to trust them to actually flash that software on the key and not inserting hardware backdoors in the first place. I highly recommend to every power user out there to get a GnuPG smartcard. It's convenient, secure, you can use it to sign and/or encrypt anything (email, files, passwords, git commits...), you can use it as an SSH key through GPG agent etc... It's well worth the ~50 euros it costs for the peace of mind it provides. Hopefully it'll make PGP more popular and make it possible to actually send encrypted emails. I can't remember the last time I've received one myself...

ghostDancer 9y ago

GnuPG Fundraising Rally https://gnupg.org/donate/ https://gnupg.org/donate/

Xophmeister 9y ago

Is GPGME, mentioned in this video, now libgcrypt, or is that something different?

0xADADA 9y ago

I thought GnuPG was so last year?

LordKano 9y ago

I'd like to see more of this covered in beginning legal CS and IS education.