3 ms·

Interesting comment about `age`: > age is a simple, modern, and secure tool for encrypting files. It's recommended to use age over PGP, if possible. Is there

Interesting comment about `age`: > age is a simple, modern, and secure tool for encrypting files. It's recommended to use age over PGP, if possible. Is there a broad consensus in favor of `age` over `gpg`?

_cenw 4y ago
GPG is a footgun factory if you use it slightly carelessly, it doesn't usually fail safely (just today, I had it ignore `default-key` because it thought it was unusable, and randomly pick another) and it has too many options. That's kind of consensus. The author of age finds even stronger words[1]. Age is very limited in scope and it's not just a random person making a cryptography tool. That's pretty good in my book. [1]: https://words.filippo.io/giving-up-on-long-term-pgp/ https://words.filippo.io/giving-up-on-long-term-pgp/
- aborsy 4y ago
  Can you mention some of these footguns? I don’t encounter footguns. Once you set up the config and write your scripts, you are good to go! Its functionality and key management are very useful. OpenPGP is also battle tested, well supported. But yeah it has too many options, and you need to know what options do, and set it up correctly. Sequoia keeps OpenPGP but provides a better UI.
  - _cenw 4y ago
    Well, I already mentioned one, implicit choices. The "opsec safe" way to work around this is usually to just use a different --homedir. Another big issue I have is how easy it is to make assumptions as a user that aren't neccessarily true. Like that an encrypted message is usually signed, and that it isn't trivial to strip off signatures from encrypted payloads. I would absolutely never assume journalists know the threat model of GPG, which properties what message has, the potholes to avoid... I'd wager that even veteran users would occasionally fall for one of the many usability issues. And if it's just "sorry I lost my key". I consider UX issues crucial to a security product, when fucking up can have severe consequences depending on what you do with GPG.

_cenw 4y ago

GPG is a footgun factory if you use it slightly carelessly, it doesn't usually fail safely (just today, I had it ignore `default-key` because it thought it was unusable, and randomly pick another) and it has too many options. That's kind of consensus. The author of age finds even stronger words[1]. Age is very limited in scope and it's not just a random person making a cryptography tool. That's pretty good in my book. [1]: https://words.filippo.io/giving-up-on-long-term-pgp/ https://words.filippo.io/giving-up-on-long-term-pgp/

aborsy 4y ago
Can you mention some of these footguns? I don’t encounter footguns. Once you set up the config and write your scripts, you are good to go! Its functionality and key management are very useful. OpenPGP is also battle tested, well supported. But yeah it has too many options, and you need to know what options do, and set it up correctly. Sequoia keeps OpenPGP but provides a better UI.
- _cenw 4y ago
  Well, I already mentioned one, implicit choices. The "opsec safe" way to work around this is usually to just use a different --homedir. Another big issue I have is how easy it is to make assumptions as a user that aren't neccessarily true. Like that an encrypted message is usually signed, and that it isn't trivial to strip off signatures from encrypted payloads. I would absolutely never assume journalists know the threat model of GPG, which properties what message has, the potholes to avoid... I'd wager that even veteran users would occasionally fall for one of the many usability issues. And if it's just "sorry I lost my key". I consider UX issues crucial to a security product, when fucking up can have severe consequences depending on what you do with GPG.