3 ms·

> The actual use cases for PGP are few and far between. I use https://www.passwordstore.org/ https://www.passwordstore.org/ with a hardware key on multiple OSe

by palata 2y ago

> The actual use cases for PGP are few and far between. I use https://www.passwordstore.org/ https://www.passwordstore.org/ with a hardware key on multiple OSes (including Linux, Android and macOS). I don't know of a better alternative to that. No, I don't want to use 1Password. I want the UX of passwordstore. And I want to be able to somehow trust the password manager I use (if it comes from a random repo on the Internet, it's harder), and to somehow trust that it will still work in a few years. PGP has been around for decades, it feels pretty official and it should stay for a while, given that people have been trying to kill it for decades and complain that it can't seem to die :-).

anotherhue 2y ago
I actually use pass in the same way, but to be fair gpg is doing some very basic pubkey crypto / HMAC in this case. Age or a sufficiently complicated openssl call could probably be swapped in if desired. HSM agent features aside.
- palata 2y ago
  > ... could probably be swapped in if desired. That's exactly my point! I do understand that in 2024, "we could probably do better than PGP if desired". But before complaining about people using PGP, maybe "we" should actually do it. It is more convenient for me to use pass with PGP than to write my own alternative just because people complain about my using PGP, right?
  - anotherhue 2y ago
    What I'm saying is that PGP is an implementation detail as far as pass is concerned. Should the pass developers choose to switch it out I don't think there would be much visible change to the users.
    - palata 2y ago
      Well that's a fundamental change that is exposed to the user: if you use pass, you need a PGP key. And if you don't know what a PGP key is, you should probably not use pass because you won't be able to use it on more than one computer and you won't be able to back it up. If you want to use it with a hardware key, you fundamentally need to know how to configure that hardware key with a PGP key. If you want to use it on Android (there is "android-password-store" for that), you need to know how to handle a PGP key. I recently discovered "passage", which is pass, but using age. If you want to use it with a hardware key, you need to setup a plugin (which is fine). If you want to use it on Android... I just don't think it exists yet (even without the hardware key). What I'm saying is that it's easy to say that "it's completely stupid to use PGP nowadays", but my experience in practice is that there are some actual use-cases where I don't have an alternative. Telling me "sure, you should write and maintain the alternative" doesn't sound like a convincing way to tell me "you don't need PGP".

by palata 2y ago

anotherhue 2y ago

I actually use pass in the same way, but to be fair gpg is doing some very basic pubkey crypto / HMAC in this case. Age or a sufficiently complicated openssl call could probably be swapped in if desired. HSM agent features aside.

palata 2y ago
> ... could probably be swapped in if desired. That's exactly my point! I do understand that in 2024, "we could probably do better than PGP if desired". But before complaining about people using PGP, maybe "we" should actually do it. It is more convenient for me to use pass with PGP than to write my own alternative just because people complain about my using PGP, right?
- anotherhue 2y ago
  What I'm saying is that PGP is an implementation detail as far as pass is concerned. Should the pass developers choose to switch it out I don't think there would be much visible change to the users.
  - palata 2y ago
    Well that's a fundamental change that is exposed to the user: if you use pass, you need a PGP key. And if you don't know what a PGP key is, you should probably not use pass because you won't be able to use it on more than one computer and you won't be able to back it up. If you want to use it with a hardware key, you fundamentally need to know how to configure that hardware key with a PGP key. If you want to use it on Android (there is "android-password-store" for that), you need to know how to handle a PGP key. I recently discovered "passage", which is pass, but using age. If you want to use it with a hardware key, you need to setup a plugin (which is fine). If you want to use it on Android... I just don't think it exists yet (even without the hardware key). What I'm saying is that it's easy to say that "it's completely stupid to use PGP nowadays", but my experience in practice is that there are some actual use-cases where I don't have an alternative. Telling me "sure, you should write and maintain the alternative" doesn't sound like a convincing way to tell me "you don't need PGP".