4 ms·

Literally the only thing I ever actually used gpg for was file encryption. I tried dong key management and signatures for a very brief period 20 years ago and g

• lrvick 11mo ago
  By very small niche group, you mean every maintainer of every widely used production linux distribution and most of the core packages that form the supply train trust layer for the entire internet? Or every reasonably competent security vulnerability disclosure team? (Even Google and Apple!) PGP is the only standardized cryptographic online identity layer we have and still very heavily used by anyone working on security critical software for signed commits, signed reviews, system administration, etc. Honestly I find it hard to take anyone seriously who works in any engineering role where security matters that is -not- using PGP smartcards to sign and push their commits, sign code reviews, sign build reproductions of container images, encrypt their passwords, etc.
  • johnisgood 11mo ago
    Thank you for your comment. For a minute I thought I was going insane because there is no way that GPG/PGP is used only by the minority. Literally everyone uses it, even non-techies. phew > any engineering role where security matters that is -not- using PGP smartcards to sign and push their commits, sign code reviews, sign build reproductions of container images, encrypt their passwords, etc. I agree. Even without smartcards, at the very least sign your commits, among other things. Absolute minimum. Very low bar.
    • zikduruqe 11mo ago
      Every time I get a dev or executive sending me a Slack message saying "can you reset my password" or "can your provision me in...", my very next reply is "please send me your public key". They do not get their credentials until they do so. And once they do, our security posture gets better and better.
      • Vegenoid 11mo ago
        I think I'm missing something, how does asking for their public key improve security or verify their identity?
        • rmunn 11mo ago
          It allows the security guy (in this case, zikduruqe) to send an email that can only be read by the person who possesses the corresponding private key. Which means that either the email is going to the executive who really does own the account, or else that the attacker has already breached that executive's laptop to the point of having acquired his private key (and passphrase, if there was one), in which case phishing attempts to get a password would be utterly pointless (like trying to pick the lock of the front door when you're already inside the house).
          • akerl_ 11mo ago
            So I email you asking for something. You say “send me your public key first”. I generate a key pair and send the public key to you. You encrypt response giving me what I wanted. How do you have any idea that I’m the person I said I am?
            • johnisgood 11mo ago
              The question makes no sense in this context. The identity verification problem is orthogonal to the encryption scheme. This problem exists regardless of PGP. If someone's Slack is compromised: With PGP: attacker gets credentials encrypted to their key Without PGP: attacker gets plaintext credentials But both fail at the same point: verifying who you're talking to. That's not a PGP problem, it's a "doing password resets over unauthenticated Slack" problem. PGP does provide multiple identity verification mechanisms, e.g. web of trust, key signing, fingerprint verification, in-person key exchange, and Keybase-style social proofs linking keys to verified accounts. The workflow described just doesn't use them. Identity verification is required for ANY secure credential exchange system; you either verify keys properly (signed by trusted parties, verified fingerprints, pre-enrolled, social proofs) or you have the same problem with passwords, TOFU SSH keys, or anything else. Are you criticizing PGP for not solving a problem that the workflow simply didn't implement a solution for?
  • tptacek 11mo ago
    Neither Google nor Apple rely on PGP for vulnerability disclosure handling. Lots of organizations publish a PGP key, but in practice rarely use them.
    • lrvick 11mo ago
      Citation needed. Both Apple and Google have updated these pages with security disclosure PGP keys in the last year. https://support.apple.com/en-us/101985 https://support.apple.com/en-us/101985 https://about.google/company-info/appsecurity/ https://about.google/company-info/appsecurity/ I design most corporate bug bounty programs the same way. Sure, people rarely use PGP, but the ones that do are usually serious and high quality, and we let them skip the tier 1 queue. Script kiddies never know how to encrypt things.
      • tptacek 11mo ago
        It has not at all been my experience that PGP-encrypted bounty submissions are fast-tracked and most (almost all, in fact) good bounty submissions aren't encrypted. Google downplays PGP in the link you provided. Apple doesn't ask people to use theirs.
        • lrvick 11mo ago
          Are we looking at the same links? It is provided as an option, the ONLY option, for those that feel encryption is merited for a sensitive report. Google page: "If you feel the need, please use our PGP public key to encrypt your communications with us." Apple page: "Apple security advisories are signed with the Apple Product Security PGP key. Sensitive security information may be encrypted to this key when communicating with Apple Product Security."
          • tptacek 11mo ago
            I think you missed some subtext that I thought was pretty obvious which is that most people don't encrypt bug bounty submissions in 2025.
  • zaphar 11mo ago
    Yes. That they have a large impact does not change the fact that not I nor anyone in my close circle uses it for that. It has been relegated to a specialized domain and use case. I have no use for maintaining a signing key. All the communications I need to secure and verify identity use a different technology for it. The fact that some tools I run might use it in the background is entirely abstracted away for me and they could get swapped by something else without me once noticing. My point still stands.
    • lrvick 11mo ago
      If you write open source code others rely on, or have any online identity that could be used for harm if stolen, it is irresponsible to not have a well published public identity signing key that cryptographically ties together your online presences to make you hard to impersonate. A key used to sign commits, binaries, code reviews, emails, or anything else of public value you produce. If you do not do anything of consequence outside of corporate walls and are just a passive consumer of technology, then you probably do not need one. The fact you have keybase in your profile indicates to me that you at least at one point mildly cared about having a cryptographic identity. Keybase just happened to have been a wildly broken implementation. Keyoxide is the path today.
      • zaphar 11mo ago
        Except that I do all of those things and I don't care about it at all nor does the absence affect me in any way. Keybase was a nifty chat.
        • lrvick 11mo ago
          Fair enough. If you care about your identity so little, I expect when your personal domain ever expires you will not mind if I buy it and impersonate you? It would be valuable for my supply chain attack education work.
          • zaphar 11mo ago
            Have at it. It's not really a part of my identity. Nor has it ever been protected by GPG.