Modern Alternatives to PGP

I feel like this is asking past the point. Without a web of trust, how are you securely signing?

You can go with somewhat centralized trust, but that only gets you do far. Or, rather, that forces everyone to deal with that centralized source. Much like the web of trust.

>how am I supposed to report security issues without gpg?

I’ve never understood this obsession with using PGP to deliver security reports (even a lot of pen testing firms do it). We trust TLS to secure all sorts of remarkably sensitive data, why do we need to add an extra layer of encryption to security reports? It just seems like an unnecessary barrier to delivering the report to me, and the user experience is terrible. On top of that managing keys and ciphertexts is an unnecessary pain. Any time I see a public key that’s some org published years or even months ago, all I can think is that in the time since they generated that, they have absolutely had a number of people who had access to the private key resign.

To me, the only threat model where something like that makes sense, is if you think your critical service providers or the government is a threat actor, and in that case PGP probably isn’t going to be enough.

No mention of an agent. One of the nice features of GPG/PGP is gpg-agent which lets me use GPG without having to type in a passphrase every time.

> No one was sending you encrypted emails anyway

Guess what! Since I moved to Germany (from the Netherlands), I noticed that people send a lot of encrypted mail. Not random Germans, sure, but where in the Netherlands the security and broader hacker community was hard to convince, in Germany it's quite widespread. My colleagues (security firm) and friendly security firms (when we collaborate) expect nothing less, and even customers supporting it is not rare (it was very rare (like, one customer in dozens) when I worked in NL).

It depends on your peers whether you find PGP is usable or not, it seems.

Then again, in Germany quite a few websites used OpenStreetMap before it was cool^W^W google raised their prices, and Linux is also more widespread. I wonder what it's caused by and how we can encourage it, since I think we (HN) would generally consider those things to be good, at least for fellow hackers, even if the tech has some edges too rough for the general population.

I like keybase, I even got a bunch of my family to use it. To them it is just a free messaging app.I use it for messages and git.

I still keep PGP/GnuPG keys up and working with email because it is universal and simple. The encrypted messages I have are easy to open and get on using a fresh machine/phone as long as I keep my key around. I don't depend on anyone to maintain their servers, etc. I'm still waiting for a modern replacement, but so far it hasn't happened for me.