lrvick

36 ms·

691.
by lrvick 1y ago
Barely. Age has Yubikey support with no reasonable long term key discovery, backup, or rotation strategy as far as I can tell. All things modern PGP tooling supports. But this is what happens when people try to re-invent the wheel without t
692.
by lrvick 1y ago
Are we looking at the same links? It is provided as an option, the ONLY option, for those that feel encryption is merited for a sensitive report. Google page: "If you feel the need, please use our PGP public key to encrypt your communi
693.
by lrvick 1y ago
Citation needed. Both Apple and Google have updated these pages with security disclosure PGP keys in the last year. https://support.apple.com/en-us/101985 https://about.google/company-info/appsecur
694.
by lrvick 1y ago
Just to name a few of the projects I work on, use, or find most interesting: https://keyoxide.org/ https://git.distrust.co/public/keyfork https://git.distrust.co/public/airgap ht
695.
by lrvick 1y ago
There are not many reasons for signing without a strategy for key discovery and verification so others can verify your signatures are really yours and not that of an imposter. SSH Authenticaton subkeys are widely shared publicly on every gi
696.
by lrvick 1y ago
I have only read that single post by that author and it passed my logic smoke test on a first pass. I am not commenting on any other work by that author and this seems like an ad hominem argument rather than refuting any content of that art
697.
by lrvick 1y ago
> It’s unclear to me any stateful keychains are implied here. Encrypted files are encrypted to a key. It could be a one time use key encrypted to another key as PGP and Age both do, but still there is a long lived secret a user must main
698.
by lrvick 1y ago
OpenSSH keys were only meant for signing OpenSSH connection handshakes. They were meant for authentication, not signing long lived data. This is why PGP has distinct authentication and signing subkey types which can have different policies
699.
by lrvick 1y ago
> When you worked with those cryptographers, did any of them stick up for PGP? Which ones? I'm not making up the attitude I'm describing. I am not going to drag anyone else or their reputations into this conversation but they c
700.
by lrvick 1y ago
Even if you ONLY care about encrypting files presumably you want to be able to decrypt them far into the future, with confidence no one else can do so. If that is the case, you probably want: 1. a long lived keychain 2. a way to securely lo
701.
by lrvick 1y ago
I read it when it was first posted and my team and I have personally done a lot to address some of the more fair points like UX. Keyfork makes the UX story dead simple for key generation and backup. Keyoxide makes key discovery and trust bo
702.
by lrvick 1y ago
Sequoia is only used as a library for a few crypto primitives that there are multiple alternatives for now we will be switching to. Thankully, because of standards, we can switch to a leaner library set without breaking compatibility. http
703.
by lrvick 1y ago
Keyfork only uses modern ECC PGP keys supported by the spec, prioritizing smartcard use, and using BIP32 KDF from a 256 bit mnemonic seed. Nothing else comes close to the broad compatibility PGP offers. Just need to ignore legacy ciphers. I
704.
by lrvick 1y ago
> I presume you can get a shell utility to pipe your key in and get that mnemonic version out if you'd like. Not possible as GnuPG does not expose access to the cryptographic seed. That said a mnemonic you generate and backup with k
705.
by lrvick 1y ago
Abusing ssh for signing is a silly thing to do in most cases when modern PGP tooling covers this and so many other use cases with established standards. Also, again, use keyoxide which is a modern decentralized alternative to keybase. You c
706.
by lrvick 1y ago
By very small niche group, you mean every maintainer of every widely used production linux distribution and most of the core packages that form the supply train trust layer for the entire internet? Or every reasonably competent security vul
707.
by lrvick 1y ago
Age only covers encryption. It does not cover signing, ssh, web of trust, hierarchical keys, key discovery, etc. It is in no way a replacement for a modern PGP keychain. Ignore GnuPG which is a shit show stuck in the 90s. PGP != GPG For a m
708.
by lrvick 1y ago
No luck needed. It was a series of intentional choices anyone could make if they wished. I co-run two tech companies in silicon valley, maintain several online communities, organize events, have an active social life, travel a lot, have man
709.
by lrvick 1y ago
Not carried a cell phone in over 5 years, and only carry any internet capable devices at all when traveling. Generally I only carry cash, a mechanical watch, and an ID. For banking I use webapps. For parking I choose lots that accept cash e
710.
by lrvick 1y ago
Anything that embarrasses or wastes the time of Sam Altman seems like a net positive to me.
711.
by lrvick 1y ago
I own everything I rely on in my digital life and am pretty happy. Just stop using proprietary software, as it is never possible to own it no matter how much money you pay. FOSS solves every software need I have, and likely for most people
712.
by lrvick 1y ago
Not always a choice unless you want to spend the night at an airport and miss the thing you are flying in for.
713.
by lrvick 1y ago
Frontier already expects digital boarding passes. I do not own a phone, so they charged me a $25 fee to print one at customer service. Except they also do not accept cash, so I had to go buy a gift card with cash from a vending machine for
714.
by lrvick 1y ago
A bank knowing what bills were issued at an ATM is not the same thing as someone being able to tell which vending machine I put it into with good cross indexing to know which bill purchased which thing, as is the case with centralized credi
715.
by lrvick 1y ago
Any device connected to cell towers is constantly having its location tracked via triangulation, which is sold to endless surveillance capitalism organizations and governments to monitor where we shop, and where we protest, to optimally man
716.
by lrvick 1y ago
Most VOIP services will route SMS to email or a messenger of your choice. I get SMS just fine on my wifi devices, which I monitor when I am expecting a delivery.
717.
by lrvick 1y ago
Any device connected to cell towers is constantly having its location tracked via triangulation, which is sold to endless surveillance capitalism organizations and governments to monitor where we shop, and where we protest, to optimally man
718.
by lrvick 1y ago
I abstain from surveillance capitalism tech which is designed to track and distract. Google, Apple, and Qualcomm controlled devices are a non starter for me. I would rather be 20 years behind in tech and have sovereignty and reasonable priv
719.
by lrvick 1y ago
The data supports exactly the claim I am making: That indeed, offloading basic tasks we could do for ourselves, like navigation, decision making etc, is robbing our brains of mental exercise that would otherwise make them stronger and less
720.
by lrvick 1y ago
I co-run two tech companies and am reachable during office hours which are mostly spent at my desk, and when I am not working I am not reachable by work, and I trust my team. If you modify your preferred lifestyle in any way for work during

More ›