3 ms·

Such as? I need an alternative which supports commutative trust relationships of some sort which are revocable.

by XorNot 10mo ago

C4K3 10mo ago
Keybase or any of the tools inspired by keybase (foks.pub etc)
- adastra22 10mo ago
  Isn’t keybase to GPG what github is to git?
adastra22 10mo ago
You (knowingly?) picked the one counter example, lol. Web of trust is the one application of PGP/GPG for which there isn’t a product ready replacement tool to point towards. GPG is built around web of trust, but this is generally believed to have been a very, very bad idea and the source of innumerable security problems for nearly every application that has tried to make use of it. The GPG replacements I would point to are purpose-built for specific domains and eschew web of trust: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/ https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/ That said, you might find what you are looking for in the Rebooting Web of Trust project, and the various decentralized identity (DID) implementations that have come out of it: https://www.weboftrust.info/ https://www.weboftrust.info/
- XorNot 10mo ago
  No I picked the case I'm dealing with most commonly: which is establishing trust. X509 certs will also do this. I have numerous criticisms of the GPG system but it's not a solution to just not implement any solution at all: I.e. I need revocation lists, I need intermediate keys, I need the ability to establish alternate chains of trust or promote a chain to trusted. Some of this is very hard to do with x509 even or not will supported.
  - adastra22 10mo ago
    Trust meaning who you should do business with? Whose advice you should take? Rather than “trust” you mean something very specific: whether a key was issued by an entity, or attested to from a set of authorities. The “web of trust” model that PGP/GPG supports is not the ideal means of implementing this.

Such as? I need an alternative which supports commutative trust relationships of some sort which are revocable.

by XorNot 10mo ago

Such as? I need an alternative which supports commutative trust relationships of some sort which are revocable.

C4K3 10mo ago

Keybase or any of the tools inspired by keybase (foks.pub etc)

adastra22 10mo ago
Isn’t keybase to GPG what github is to git?

adastra22 10mo ago

You (knowingly?) picked the one counter example, lol. Web of trust is the one application of PGP/GPG for which there isn’t a product ready replacement tool to point towards. GPG is built around web of trust, but this is generally believed to have been a very, very bad idea and the source of innumerable security problems for nearly every application that has tried to make use of it. The GPG replacements I would point to are purpose-built for specific domains and eschew web of trust: https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/ https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/ That said, you might find what you are looking for in the Rebooting Web of Trust project, and the various decentralized identity (DID) implementations that have come out of it: https://www.weboftrust.info/ https://www.weboftrust.info/

XorNot 10mo ago
No I picked the case I'm dealing with most commonly: which is establishing trust. X509 certs will also do this. I have numerous criticisms of the GPG system but it's not a solution to just not implement any solution at all: I.e. I need revocation lists, I need intermediate keys, I need the ability to establish alternate chains of trust or promote a chain to trusted. Some of this is very hard to do with x509 even or not will supported.
- adastra22 10mo ago
  Trust meaning who you should do business with? Whose advice you should take? Rather than “trust” you mean something very specific: whether a key was issued by an entity, or attested to from a set of authorities. The “web of trust” model that PGP/GPG supports is not the ideal means of implementing this.