51–60 of 137 posts
Age is a much better experience than PGP/GPG, even though it only has a subset of GPG's features. The option and argument handling is intuitive; it makes sense instantly. It gives a more grounded understanding of what's happening with the encryption process, especially because of the short-form recipient format. Also, setting it up with a Yubikey and Passage (a GNU pass alternative for Age) was a breeze.
> The author pronounces it [aɡe̞] with a hard g, like GIF Lol, or 'git' according to one of my more sensitive colleagues.
For someone that never ever needs signing or authentication, including for ones own backups, who never has malware in their threat model, and trusts this specless tool will be maintained forever, maybe this makes sense? Even then openssl or sq can solve the problem in the same number of commands but with sntabdards. Most people are best off going with a modern implementation of the PGP standard, ideally via a smart c…
There is also an official typescript implementation [1] and sops supports it natively [2]. [1] https://github.com/FiloSottile/typage [2] https://github.com/getsops/sops?tab=readme-ov-file#encryptin...
https://www.kryptor.co.uk/ is much more secure than age. From their FAQ [0]: >Kryptor uses strong, fast, and modern cryptographic algorithms, offering post-quantum security. It also addresses security limitations of tools like age and Minisign. >Unlike most tools, Kryptor limits metadata by using an indistinguishable from random encrypted file format. Encrypted files have no identifiable headers and are randomly padd…
Age (and its rust implementation Rage) combined with agenix[0] and age.el[1] has made my self-hosted deployment and management so, so easy without compromising security. That, when combined with general NixOS conveniences is why I'm able to self-host at all. If not for these, just the anxiety of having to setup new server in case of whatever loss and the associated time/opportunity loss kept me from dong the same for…
Earlier quoted context omitted.
Can you elaborate on how age (and the downstream packages) has made a difference in your workflows?
With agenix, you can encrypt your secrets, such as API keys, and have them stored in your git repo alongside the system configuration (which in nixos is just a bunch of text files). Then you only need to provision the server with the ed25519 private key corresponding to the pubkey the files were encrypted with, and agenix will automatically decrypt the files on boot and place them in /run/agenix, with the specified a…
The description claims it's "secure", but nothing pops up in the README when I Ctrl+F `audit`. So maybe take the "secure" claims with a grain of salt.
The description claims these curves are "safe" but nothing pops up when I Ctrl+F `audit`. https://safecurves.cr.yp.to
That aside, of course DJB would choose criteria that let him label his own curve as "safe".
I'm no cryptographer so ultimately I have no choice but to rely on others' expertise, but that does not mean I take at face value the words of someone talking about their own project. Probably for the same reason HN requires disclosure when talking about something you're involved in.
https://www.kryptor.co.uk/ is much more secure than age. From their FAQ [0]: >Kryptor uses strong, fast, and modern cryptographic algorithms, offering post-quantum security. It also addresses security limitations of tools like age and Minisign. >Unlike most tools, Kryptor limits metadata by using an indistinguishable from random encrypted file format. Encrypted files have no identifiable headers and are randomly padd…
Thanks for sharing, always happy when my projects inspire alternatives addressing different parts of the design space. Here are a few quick comments based on skimming the documentation, let me know if I misinterpreted anything. - signing support This has always been a non-goal for age. It makes the UX significantly more complex, but it's good if different tools have different goals. I can't quite make out from https:…
other than inelegance and the computational overhead, is there a reason why sign then encrypt then sign wouldn't work for this?
Earlier quoted context omitted.
With agenix, you can encrypt your secrets, such as API keys, and have them stored in your git repo alongside the system configuration (which in nixos is just a bunch of text files). Then you only need to provision the server with the ed25519 private key corresponding to the pubkey the files were encrypted with, and agenix will automatically decrypt the files on boot and place them in /run/agenix, with the specified a…
So you still need a secret when provisioning, and you need to handle change management for that, and storing it securely outside of the git repo. And agenix did not change that workflow, or did it?
I only need to care about my SSH key(s). Which I had to anyway. But now the secrets for all the services (except SSH) lie right besides their config. Any change in one or other is directly visible in git log.
In short, age cut down on the number and types of secrets that I have to manage out of band. Which is very good. It's always easier to be able to remember 2 things (config + SSH keys) than 2+n things (config + SSH keys + whatever secret mechanism any service uses, times number of services).