| ▲ | The PGP Problem (2019)(latacora.com) |
| 15 points by croemer 6 days ago | 11 comments |
| |
|
| ▲ | maqp an hour ago | parent | next [-] |
| The biggest issue with PGP/gpg is the difficulty of getting rid of it. If you work on big distros, or know someone who works on big distros, please (start asking them to) add https://github.com/jedisct1/minisign to pre-installed packages to facilitate transition. It's almost a chicken egg problem but the sad thing is, no project wants to swap the signing tool to a better one until everyone can verify the new signatures. |
|
| ▲ | shakna 2 hours ago | parent | prev | next [-] |
| Probably resurfacing, because we have some new attacks thanks to CCC. [0] [0] https://news.ycombinator.com/item?id=46453461 |
| |
| ▲ | shakna an hour ago | parent [-] | | Worth noting: minisign and age were also affected by a couple things here. GnuPG has decided a couple things are out of scope, fixed a couple others. Not all is in distro packages yet. age didn't have the clearest way to report things - discord is apparently the point of contact. Which will probably improve soon. minisign was affected by most everything GnuPG was, but had a faster turnaround to patching. |
|
|
| ▲ | felipelalli 2 hours ago | parent | prev | next [-] |
| Even though I read so many posts criticizing PGP, it's still difficult for me to find an alternative. He states in the article that being a "Swiss Army Knife" is bad. I understand the argument, but this is precisely what makes GPG so powerful. The scheme of public keys, private keys, revoke, embedded WOT, files, texts, everything. They urgently need to make a "modern version" of GPG. He needs a replacement, otherwise he'll just be whining. |
| |
| ▲ | schoen an hour ago | parent [-] | | There's a section in this post with proposed replacements: https://www.latacora.com/blog/2019/07/16/the-pgp-problem/#th... I was also frustrated with this criticism in the past, but there are definitely some concrete alternatives provided for many use cases there. (But not just with one tool.) | | |
| ▲ | eddythompson80 32 minutes ago | parent [-] | | I’m still frustrated by the criticism because I internalized it a couple of years ago and tried to move to age+minisig because those are the only 2 scenarios I personally care about. The overall experience was annoying given that the problems with pgp/gpg are esoteric and abstract that unless I’m personally are worried about a targeted attack against me, they are fine-ish. If someone scotch tapes age+minisig and convince git/GitHub/gitlab/codeberge to support it, I’ll be so game it’ll hurt. My biggest usage of pgp is asking people doing bug reports to send me logs and giving them my pgp keys if they are worried and don’t want to publicly post their log file. 99.9% of people don’t care, but I understand the 0.1% who do. The other use is to sign my commits and to encrypt my backups. Ps: the fact that this post is recommending Tarsnap and magicwormhole shows how badly it has aged in 6 years IMO. | | |
| ▲ | nine_k 9 minutes ago | parent | next [-] | | Has Tarsnap become inadequate, security-wise? The service may be expensive for a standard backup. It had a serious bug in 2011, but hasn't it been adequate since then? | |
| ▲ | aniviacat 16 minutes ago | parent | prev [-] | | > the fact that this post is recommending Tarsnap and magicwormhole shows how badly it has aged in 6 years What's wrong with magic wormhole? | | |
| ▲ | eddythompson80 a minute ago | parent [-] | | It’s just not the same thing. There is significant overlap, but it’s not enough to be a reasonable suggestion. You can’t suggest a service as a replacement for a local offline tool. It’s like saying “Why do you need VLC when you can just run peertube?”. Also since then, age is the real replacement for pgp in terms of sending encrypted files. Wormhole is a different use case. |
|
|
|
|
|
| ▲ | bgwalter 26 minutes ago | parent | prev | next [-] |
| How does this help people who are not following this issue regularly? gpg protected Snowden, and this article promotes tools by one of the cryptographers who promoted non-hybrid encryption: https://blog.cr.yp.to/20251004-weakened.html#agreement So what to do? PGP by the way never claimed to prevent traffic analysis, mixmaster was the layer that somehow got dropped, unlike Tor. |
|
| ▲ | jairuhme 2 hours ago | parent | prev [-] |
| Can the link be updated to not be to the end of the page? |
