Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Age is a simple, modern and secure file encryption tool, format, and Go library

github.com

Post reply on HN
Print view View original

61–70 of 137 posts

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#61

Post by tantalor »

quectophoton wrote: post #22
klabb3 wrote: post #21

Earlier quoted context omitted.

Meh. The author of age is very experienced and known specifically for security, crypto and within the implementation language (Go). Audits are only as good as the competence of the auditors and can often turn into checklist rituals. It certainly doesn’t hurt, but audits are not a panacea.

Agreed, but IMHO claiming that a crypto library is secure without providing independent verification, is like claiming something is fast without providing benchmarks. (And both are the same in the sense that neither is a panacea.) I'm only bringing up audits because such claim was made, but maybe I should have said "independent verification" instead since it's more general.

Sounds like a false analogy.

"independent verification" is subjective. Who does the verification, do you trust them, how do you know they didn't screw up.

"benchmarks" are objective. A is faster than B, we know because of the way that it is.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#63

Post by Foxboron »

e3bc54b2 wrote: post #60
fmbb wrote: post #57

Earlier quoted context omitted.

So you still need a secret when provisioning, and you need to handle change management for that, and storing it securely outside of the git repo. And agenix did not change that workflow, or did it?

Yes and no. I only need to care about my SSH key(s). Which I had to anyway. But now the secrets for all the services (except SSH) lie right besides their config. Any change in one or other is directly visible in git log. In short, age cut down on the number and types of secrets that I have to manage out of band. Which is very good. It's always easier to be able to remember 2 things (config + SSH keys) than 2+n things…

You could also include SSH keys as public secrets.

https://github.com/Foxboron/ssh-tpm-agent

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#65

Post by KolmogorovComp »

hosteur wrote: post #30
FiloSottile wrote: post #15

_o/ hi all, age author here! age is the one of my projects that grew most organically into an ecosystem. It's always great to see what people build with it. Happy to answer any questions. Here are some previous discussions 132 points on Feb 26, 2023 | 77 comments | https://news.ycombinator.com/item?id=34936504 126 points on Sept 26, 2022 | 54 comments | https://news.ycombinator.com/item?id=32980141 113 points on June…

Hi Do you have an opinion or comment on this? https://news.ycombinator.com/item?id=41159236

For those wondering, they answered https://news.ycombinator.com/item?id=41160037

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#66

Post by e3bc54b2 »

SOLAR_FIELDS wrote: post #48
sharperguy wrote: post #40

Earlier quoted context omitted.

With agenix, you can encrypt your secrets, such as API keys, and have them stored in your git repo alongside the system configuration (which in nixos is just a bunch of text files). Then you only need to provision the server with the ed25519 private key corresponding to the pubkey the files were encrypted with, and agenix will automatically decrypt the files on boot and place them in /run/agenix, with the specified a…

So like SOPS, but specific to nix somehow? What is the advantage of the nixy integration here vs the universality of SOPS? Better native integration with NixOS?

Similar to sops in a sense that both allow encryption/decryption with SSH keys.

In terms of NixOS integration, both are on equal footing.

I'm just unfond of yaml is all.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#68

Post by woodruffw »

lrvick wrote: post #14

For someone that never ever needs signing or authentication, including for ones own backups, who never has malware in their threat model, and trusts this specless tool will be maintained forever, maybe this makes sense? Even then openssl or sq can solve the problem in the same number of commands but with sntabdards. Most people are best off going with a modern implementation of the PGP standard, ideally via a smart c…

Age uses standard (and modern) cryptography, and is itself standardized[1].

This is in contrast to the PGP ecosystem, which is infamously fragmented and insistent on maintaining support for insecure and home-baked schemes (e.g. 4880’s weird custom CFB mode). Sequoia has made some progress on the UX side of things, but PGP is a dead horse as far as modern, even conservative cryptographic software design goes.

[1]: https://github.com/C2SP/C2SP/blob/main/age.md

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#69

Post by valczir »

ElectricalUnion wrote: post #32
max-privatevoid wrote: post #23

Earlier quoted context omitted.

But then you'd have to use YAML

If the thing accepts YAML it often also accepts a equivalent JSON.

yaml is a superset of json, so by definition anything that accepts yaml _must_ accept json

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#70

Post by tptacek »

quectophoton wrote: post #19

The description claims it's "secure", but nothing pops up in the README when I Ctrl+F `audit`. So maybe take the "secure" claims with a grain of salt.

This drives me a little nuts. There are something like 4 firms† in the world generally recognized as qualified for assessing cryptosystems, against dozens well-known and qualified to audit software but not cryptography. Cryptography is a rare specialty for software security people. How were you going to know whether an "audit" for age was meaningful?

† and, to be fair, dozens of independent practitioners

Post reply on HN