3 ms·

How much can I trust Minisign and Sigstore? I mean PGP is everywhere, everybody knows what it is and it has been maintained for decades. If I sign a file with

by palata 2y ago

How much can I trust Minisign and Sigstore? I mean PGP is everywhere, everybody knows what it is and it has been maintained for decades. If I sign a file with Minisign, how likely is it that the person who will want to check the signature will know what Minisign is, will be on a system that has a trustworthy implementation of it, and how likely is it that this implementation will be maintained for at least some years? And does Minisign work with hardware keys? I looked at the Sigstore website, and to be very honest I don't really understand what it does. They seem to have a tool for signing containers (not my use-case) and other things I don't think I do. Do they have a tool to sign a file? Then should I use Minisign or Sigstore, or both? And expect other people to know both? What if they use 2 other systems they like, should I now use 4? With PGP this all seems pretty obvious, and PGP signatures don't seem to be bad, right?

palata 2y ago
[flagged]
- tptacek 2y ago
  If you want to publish a PGP signature of your own random files, go ahead and do it; nobody is going to dunk on you for it. If you're managing a major platform, use something better than PGP, which wasn't designed for this problem. See Python's experience with PGP signatures --- and, especially, with reliably verifying them --- for reasons why. Also: if you're "genuinely" asking questions, you might want to be careful about back-loading them with assertions that suggest you already believe you know the answer, and aren't so much asking as hoping to bait something you can rebut.
  - palata 2y ago
    > if you're "genuinely" asking questions, you might want to be careful about back-loading them with assertions that suggest you already believe you know the answer I don't know the answers. English is not my language, so I express myself as best as I can. I just re-read my answer above, and what you are saying isn't obvious to me. Not saying you're wrong: most likely you are right. Maybe I should write in my first language and hope that people translate it :-). I am just saying that it's often worth assuming good faith. It's not the first time I try to ask when I see criticism of PGP, and I still don't have answers. I am not saying PGP is great: just that I can actually use it with my hardware keys everywhere I need to. When I search for "minisign", I find different repositories from different authors I don't know. Is it better to use PGP or to use some alternative from the first result given by my search engine? Some other thoughts (all are things I can currently do with PGP): * age is written in Go, so I assume it won't work on Android. Are there alternatives that support Android? I haven't found any. * rage is written in rust. Assuming it is trustworthy (it's not the same author as age), I haven't seen any information about Android. * The age-plugin-yubikey doesn't seem to work on Android [4] * It's really not clear to me if minisign works with hardware keys [1][2]. There is an "experimental" fork by Yubico, but it hasn't been updated in a year [3]. Not sure about other hardware keys. [1]: https://github.com/jedisct1/minisign/issues/100 https://github.com/jedisct1/minisign/issues/100 [2]: https://github.com/jedisct1/minisign/issues/95 https://github.com/jedisct1/minisign/issues/95 [3]: https://github.com/YubicoLabs/minisign-fido/ https://github.com/YubicoLabs/minisign-fido/ [4]: https://github.com/str4d/age-plugin-yubikey/issues/109 https://github.com/str4d/age-plugin-yubikey/issues/109
- cpach 2y ago
  GnuPG is confusing, but what’s worse: It’s also old and crappy and it tries to be all things to all people. There’s very few reasons to still use it in the year 2024. https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/ https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/
  - palata 2y ago
    I use pass [1] as a password manager. It uses PGP. I use it with a hardware key. Is there an alternative that doesn't use PGP? I would be happy to use it, I just haven't found anything. My issue is that as soon as I have PGP configured for pass, I don't really have a reason for not using PGP for other things (like encrypting files or signing stuff). [1]: https://www.passwordstore.org/ https://www.passwordstore.org/

by palata 2y ago

palata 2y ago

[flagged]

tptacek 2y ago
If you want to publish a PGP signature of your own random files, go ahead and do it; nobody is going to dunk on you for it. If you're managing a major platform, use something better than PGP, which wasn't designed for this problem. See Python's experience with PGP signatures --- and, especially, with reliably verifying them --- for reasons why. Also: if you're "genuinely" asking questions, you might want to be careful about back-loading them with assertions that suggest you already believe you know the answer, and aren't so much asking as hoping to bait something you can rebut.
- palata 2y ago
  > if you're "genuinely" asking questions, you might want to be careful about back-loading them with assertions that suggest you already believe you know the answer I don't know the answers. English is not my language, so I express myself as best as I can. I just re-read my answer above, and what you are saying isn't obvious to me. Not saying you're wrong: most likely you are right. Maybe I should write in my first language and hope that people translate it :-). I am just saying that it's often worth assuming good faith. It's not the first time I try to ask when I see criticism of PGP, and I still don't have answers. I am not saying PGP is great: just that I can actually use it with my hardware keys everywhere I need to. When I search for "minisign", I find different repositories from different authors I don't know. Is it better to use PGP or to use some alternative from the first result given by my search engine? Some other thoughts (all are things I can currently do with PGP): * age is written in Go, so I assume it won't work on Android. Are there alternatives that support Android? I haven't found any. * rage is written in rust. Assuming it is trustworthy (it's not the same author as age), I haven't seen any information about Android. * The age-plugin-yubikey doesn't seem to work on Android [4] * It's really not clear to me if minisign works with hardware keys [1][2]. There is an "experimental" fork by Yubico, but it hasn't been updated in a year [3]. Not sure about other hardware keys. [1]: https://github.com/jedisct1/minisign/issues/100 https://github.com/jedisct1/minisign/issues/100 [2]: https://github.com/jedisct1/minisign/issues/95 https://github.com/jedisct1/minisign/issues/95 [3]: https://github.com/YubicoLabs/minisign-fido/ https://github.com/YubicoLabs/minisign-fido/ [4]: https://github.com/str4d/age-plugin-yubikey/issues/109 https://github.com/str4d/age-plugin-yubikey/issues/109
cpach 2y ago
GnuPG is confusing, but what’s worse: It’s also old and crappy and it tries to be all things to all people. There’s very few reasons to still use it in the year 2024. https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/ https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/
- palata 2y ago
  I use pass [1] as a password manager. It uses PGP. I use it with a hardware key. Is there an alternative that doesn't use PGP? I would be happy to use it, I just haven't found anything. My issue is that as soon as I have PGP configured for pass, I don't really have a reason for not using PGP for other things (like encrypting files or signing stuff). [1]: https://www.passwordstore.org/ https://www.passwordstore.org/