4 ms·

PGP is not widely accepted because keeping persistent keys is not a skill the average person in IT, let alone generally has. It is also very hard to fix errors.

PGP is not widely accepted because keeping persistent keys is not a skill the average person in IT, let alone generally has. It is also very hard to fix errors. Using subkeys without the certify key has always been a bit of a hack. GPG doesn't even have a nice command to pull out the C key from your keychain and save it somewhere else. FIDO2 keys for SSH are much better for the average person.

upofadown 5y ago
>Using subkeys without the certify key has always been a bit of a hack. I am not sure what is meant by this. Standalone subkeys are impossible. I think this might be a reference to the case where you store the private key for the certify key somewhere safer than the rest. Which, BTW, IMO, is something very few people need to do, although it seems to have become somewhat of a fad.
- sascha_sl 5y ago
  When I say key, I'm obviously talking about the private key. It honestly seems like the only reason you'd want to rotate subkeys or have distinct ones for different devices. Otherwise you're going to be stuck with at least one perpetual key anyway. It makes GPG somewhat more usable after you're done issing subkeys on your super secure airgapped workstation, because now losing a key/machine isn't a death sentence to your perpetual forever-lived identity. But then again, it's not like you can't reply to a PGP encrypted message with "sorry i lost my keys new fingerprint is x, please use that one" and most people will just do that.
  - upofadown 5y ago
    The way I look at is is that the chance of a PGP key compromise over someone's lifetime is so close to zero as to not matter. Rebuilding your reputation is at the most just inconvenient. Redemption certificates actually work with PGP so you wouldn't have to worry about old identities hanging around.

4 ms·

PGP is not widely accepted because keeping persistent keys is not a skill the average person in IT, let alone generally has. It is also very hard to fix errors.

by sascha_sl 5y ago

upofadown 5y ago
>Using subkeys without the certify key has always been a bit of a hack. I am not sure what is meant by this. Standalone subkeys are impossible. I think this might be a reference to the case where you store the private key for the certify key somewhere safer than the rest. Which, BTW, IMO, is something very few people need to do, although it seems to have become somewhat of a fad.
- sascha_sl 5y ago
  When I say key, I'm obviously talking about the private key. It honestly seems like the only reason you'd want to rotate subkeys or have distinct ones for different devices. Otherwise you're going to be stuck with at least one perpetual key anyway. It makes GPG somewhat more usable after you're done issing subkeys on your super secure airgapped workstation, because now losing a key/machine isn't a death sentence to your perpetual forever-lived identity. But then again, it's not like you can't reply to a PGP encrypted message with "sorry i lost my keys new fingerprint is x, please use that one" and most people will just do that.
  - upofadown 5y ago
    The way I look at is is that the chance of a PGP key compromise over someone's lifetime is so close to zero as to not matter. Rebuilding your reputation is at the most just inconvenient. Redemption certificates actually work with PGP so you wouldn't have to worry about old identities hanging around.