GPG-Tui, a Terminal User Interface for GnuPG
1–10 of 105 posts
Re: GPG-Tui, a Terminal User Interface for GnuPG
#2The poor UX behind gpg dissuaded me (and likely many others) from using it. Love the tree layout that's used here... time to get back into gpg.
Re: GPG-Tui, a Terminal User Interface for GnuPG
#3Eh. Still think we need a decent GUI version that integrates with things seamlessly. Like a password manager does.
Re: GPG-Tui, a Terminal User Interface for GnuPG
#4While this is awesome work, it seems pointless since the protocol and ecosystem around it is so hopelessly convoluted, misunderstood, and in a varying state of abandonment. All my friends in the security steer well clear of it.
Re: GPG-Tui, a Terminal User Interface for GnuPG
#5While this is awesome work, it seems pointless since the protocol and ecosystem around it is so hopelessly convoluted, misunderstood, and in a varying state of abandonment. All my friends in the security steer well clear of it.
What do they use instead?
Re: GPG-Tui, a Terminal User Interface for GnuPG
#6While this is awesome work, it seems pointless since the protocol and ecosystem around it is so hopelessly convoluted, misunderstood, and in a varying state of abandonment. All my friends in the security steer well clear of it.
If you approach it from "run these commands to do these things" it's not bad. Most wrappers are wrappers around a very limited set of functionality.
It sticks around because it has some interface that users can use and is scriptable. Everyone saying GPG is bad usually has no general solution to replacing it.
Re: GPG-Tui, a Terminal User Interface for GnuPG
#7The poor UX behind gpg dissuaded me (and likely many others) from using it. Love the tree layout that's used here... time to get back into gpg.
I really don't get this attitude, though I think it must be valid, since I seem to be almost alone in disagreement. I use plain old GPG for a lot of purposes, and I don't find its command-line usage difficult at all. Key management, encryption, decryption, signing — all of these operations are pretty straightforward.
What specific tasks have you found difficult?
Re: GPG-Tui, a Terminal User Interface for GnuPG
#8While this is awesome work, it seems pointless since the protocol and ecosystem around it is so hopelessly convoluted, misunderstood, and in a varying state of abandonment. All my friends in the security steer well clear of it.
What do they use instead?
Standard replacements:
For signing: signify/minisign
For encryption: age
For file transfer: magic wormhole
For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)
Re: GPG-Tui, a Terminal User Interface for GnuPG
#9While this is awesome work, it seems pointless since the protocol and ecosystem around it is so hopelessly convoluted, misunderstood, and in a varying state of abandonment. All my friends in the security steer well clear of it.
If you approach it from "run these commands to do these things" it's not bad. Most wrappers are wrappers around a very limited set of functionality. It sticks around because it has some interface that users can use and is scriptable. Everyone saying GPG is bad usually has no general solution to replacing it.
The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination.
A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a single toolset or even a single standard design that handles multiple problems. Messaging cryptography is not the same as backup cryptography, which in turn isn't the same as secure transports, or package update security.
More here: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
Re: GPG-Tui, a Terminal User Interface for GnuPG
#10Earlier quoted context omitted.
If you approach it from "run these commands to do these things" it's not bad. Most wrappers are wrappers around a very limited set of functionality. It sticks around because it has some interface that users can use and is scriptable. Everyone saying GPG is bad usually has no general solution to replacing it.
The best-known problem with PGP is its poor usability, but that's not its biggest problem. It's biggest problem is an archaic design that literally predates much of modern cryptography; most egregiously, PGP is almost never forward-secret, and almost always relies on long-term keys, which is a deadly combination. A more fundamental design issue is simply that cryptography engineers long ago abandoned the idea of a si…
Is there a way to do forward security in a non-interactive protocol (which seems necessary, if you want to communicate over email?)
I guess users could publish partial key exchanges out of band?