3 ms·
Can you mention some of these footguns? I don’t encounter footguns. Once you set up the config and write your scripts, you are good to go! Its functionality an
by aborsy 4y ago
Can you mention some of these footguns? I don’t encounter footguns.
Once you set up the config and write your scripts, you are good to go! Its functionality and key management are very useful. OpenPGP is also battle tested, well supported.
But yeah it has too many options, and you need to know what options do, and set it up correctly.
Sequoia keeps OpenPGP but provides a better UI.
- _cenw 4y agoWell, I already mentioned one, implicit choices. The "opsec safe" way to work around this is usually to just use a different --homedir. Another big issue I have is how easy it is to make assumptions as a user that aren't neccessarily true. Like that an encrypted message is usually signed, and that it isn't trivial to strip off signatures from encrypted payloads. I would absolutely never assume journalists know the threat model of GPG, which properties what message has, the potholes to avoid... I'd wager that even veteran users would occasionally fall for one of the many usability issues. And if it's just "sorry I lost my key". I consider UX issues crucial to a security product, when fucking up can have severe consequences depending on what you do with GPG.