3 ms·

I actually use pass in the same way, but to be fair gpg is doing some very basic pubkey crypto / HMAC in this case. Age or a sufficiently complicated openssl ca

I actually use pass in the same way, but to be fair gpg is doing some very basic pubkey crypto / HMAC in this case. Age or a sufficiently complicated openssl call could probably be swapped in if desired. HSM agent features aside.

palata 2y ago
> ... could probably be swapped in if desired. That's exactly my point! I do understand that in 2024, "we could probably do better than PGP if desired". But before complaining about people using PGP, maybe "we" should actually do it. It is more convenient for me to use pass with PGP than to write my own alternative just because people complain about my using PGP, right?
- anotherhue 2y ago
  What I'm saying is that PGP is an implementation detail as far as pass is concerned. Should the pass developers choose to switch it out I don't think there would be much visible change to the users.
  - palata 2y ago
    Well that's a fundamental change that is exposed to the user: if you use pass, you need a PGP key. And if you don't know what a PGP key is, you should probably not use pass because you won't be able to use it on more than one computer and you won't be able to back it up. If you want to use it with a hardware key, you fundamentally need to know how to configure that hardware key with a PGP key. If you want to use it on Android (there is "android-password-store" for that), you need to know how to handle a PGP key. I recently discovered "passage", which is pass, but using age. If you want to use it with a hardware key, you need to setup a plugin (which is fine). If you want to use it on Android... I just don't think it exists yet (even without the hardware key). What I'm saying is that it's easy to say that "it's completely stupid to use PGP nowadays", but my experience in practice is that there are some actual use-cases where I don't have an alternative. Telling me "sure, you should write and maintain the alternative" doesn't sound like a convincing way to tell me "you don't need PGP".

palata 2y ago

> ... could probably be swapped in if desired. That's exactly my point! I do understand that in 2024, "we could probably do better than PGP if desired". But before complaining about people using PGP, maybe "we" should actually do it. It is more convenient for me to use pass with PGP than to write my own alternative just because people complain about my using PGP, right?

anotherhue 2y ago
What I'm saying is that PGP is an implementation detail as far as pass is concerned. Should the pass developers choose to switch it out I don't think there would be much visible change to the users.
- palata 2y ago
  Well that's a fundamental change that is exposed to the user: if you use pass, you need a PGP key. And if you don't know what a PGP key is, you should probably not use pass because you won't be able to use it on more than one computer and you won't be able to back it up. If you want to use it with a hardware key, you fundamentally need to know how to configure that hardware key with a PGP key. If you want to use it on Android (there is "android-password-store" for that), you need to know how to handle a PGP key. I recently discovered "passage", which is pass, but using age. If you want to use it with a hardware key, you need to setup a plugin (which is fine). If you want to use it on Android... I just don't think it exists yet (even without the hardware key). What I'm saying is that it's easy to say that "it's completely stupid to use PGP nowadays", but my experience in practice is that there are some actual use-cases where I don't have an alternative. Telling me "sure, you should write and maintain the alternative" doesn't sound like a convincing way to tell me "you don't need PGP".