4 ms·
GPG is “well-established” in the sense that it’s old; it’s not considered a modern or well-designed digital signing (or encryption, or trust distribution, etc.)
by woodruffw 3y ago
GPG is “well-established” in the sense that it’s old; it’s not considered a modern or well-designed digital signing (or encryption, or trust distribution, etc.) scheme.
I think there are significant issues with establishing the “authenticity” of digital artifacts in any scheme, but GPG would probably make things worse rather than better here.
- b0afc375b5 3y agoWhat are the modern / well-designed alternatives?
- computerfriend 3y agoThe GPG hate is, in my opinion, overblown. But modern alternatives would be SSH signing, signify/minisign or cosign.
- woodruffw 3y agoThere is no “alternative” to GPG, because PGP/GPG’s problem space is poorly defined. Modern cryptographic protocol design has moved away from “Swiss Army knife” designs: protocols and formats are now designed to do one thing well, rather than a whole bunch of things poorly and with an unintuitive user interface. In other words: use TLS to communicate securely with services. Use Signal or another modern E2EE IM protocol to communicate securely with humans. For file encryption, use age. For digital signatures, use minisign or Sigstore.
- backendanon 3y agoGPG is not good now? When did that happen?
- woodruffw 3y agoIt’s been about a decade[1]. You can find older links as well, but that’s a decently old one from an authoritative source. [1]: https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-pgp/ https://blog.cryptographyengineering.com/2014/08/13/whats-ma...
- backendanon 3y agoOk. I read it, thanks. I plan to continue using GPG.