Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Age is a simple, modern and secure file encryption tool, format, and Go library

github.com

Post reply on HN
Print view View original

111–120 of 137 posts

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#111

Post by FiloSottile »

colmmacc wrote: post #109
FiloSottile wrote: post #35

Earlier quoted context omitted.

Thanks for sharing, always happy when my projects inspire alternatives addressing different parts of the design space. Here are a few quick comments based on skimming the documentation, let me know if I misinterpreted anything. - signing support This has always been a non-goal for age. It makes the UX significantly more complex, but it's good if different tools have different goals. I can't quite make out from https:…

Massive fan of age and congrats on its success!! On size padding, I know you've patiently listened to me before on this, but I'll always take a chance to advocate for an approach like PURBs ( https://petsymposium.org/2019/files/papers/issue4/popets-201... ). Let's say you're in a country that suppresses certain material, like copies of the Bible, or the Hacker Manifesto, or whatever; if the authorities find an encryp…

My age v2 note for padding says “use Padmé, see Colm’s comments” :)

I’m not really sold on the UR part of PURBs, though: age wants to avoid asking for a passphrase if the file is not passphrase encrypted, and age-plugin-yubikey wants to avoid asking for a PIN if it’s for the wrong YubiKey. These are tradeoffs and it’s not obvious the very end of the spectrum (uniform random) is the right spot.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#112

Post by e12e »

amluto wrote: post #42
lrvick wrote: post #14

For someone that never ever needs signing or authentication, including for ones own backups, who never has malware in their threat model, and trusts this specless tool will be maintained forever, maybe this makes sense? Even then openssl or sq can solve the problem in the same number of commands but with sntabdards. Most people are best off going with a modern implementation of the PGP standard, ideally via a smart c…

> Even then openssl or sq can solve the problem in the same number of commands but with sntabdards. Using OpenSSL to properly encrypt a file is next to impossible, and if you actually succeed at doing so, you’re very unlikely to be following a defined standard. I’m not familiar with sq. > modern implementation of the PGP standard The PGP standard is an unmitigated disaster.

> I’m not familiar with sq.

The reimplantation of PGP as a clean rust implantation with a simple cli (sq) is imnho quite exiting:

https://sequoia-pgp.gitlab.io/sq-user-guide/

I do think perhaps it's too little too late - bit in contrast with age it does provide for signing and authentication as well as simple(-ish) key/certificate management.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#113

Post by t0astbread »

SOLAR_FIELDS wrote: post #48
sharperguy wrote: post #40

Earlier quoted context omitted.

With agenix, you can encrypt your secrets, such as API keys, and have them stored in your git repo alongside the system configuration (which in nixos is just a bunch of text files). Then you only need to provision the server with the ed25519 private key corresponding to the pubkey the files were encrypted with, and agenix will automatically decrypt the files on boot and place them in /run/agenix, with the specified a…

So like SOPS, but specific to nix somehow? What is the advantage of the nixy integration here vs the universality of SOPS? Better native integration with NixOS?

To clarify maybe, NixOS puts all configuration and program files it handles in a world-readable object store on disk. If you want to manage secrets on NixOS securely, you have two choices:

- Manage it out of band. That negates all of the benefits of NixOS, at least for those files. (I.e. you would need additional deployment steps, rollback wouldn't work, you would have to stop and migrate system services that depend on those secrets yourself, etc.)

- Encrypt it and only decrypt it on activation (which happens when switching to a new config or on boot). agenix and nix-sops (the premier SOPS/NixOS integration) are two libraries that you can include in your config to do that. With this, the world-readable store only contains encrypted secrets.

Of course with #2 you still have to manage your private keys (age or whatever SOPS uses) out-of-band but that is significantly less work since those aren't expected to change nearly as much. You can also generally decouple that from your day-to-day deployment workflow.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#114

Post by [deleted] »

upofadown wrote: post #85
jjice wrote: post #78

It would be fantastic if Age (or at least something similar) could become standard on Unix machines. I'd love a more Unix-philosophy following tool than GPG/PGP to be around for encryption. That said, I don't think new standard tools for Unix machines are very common. The closest thing I can think of in the last while is `jq`, but it's not "preinstalled on your machine" kind of standard, just "my script might just us…

Doing one thing and doing it well is all and good, but most people are not interested in having to manually mess around with up to 4 raw keys in the pursuit of that. That's particularly true if you are doing pipes and you don't have any good place to put all those keys. Most of the time you want to go: gpg --sign --encrypt file ... and be done with it.

[deleted]

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#115

Post by gjvc »

kitd wrote: post #92
thaumasiotes wrote: post #38

Earlier quoted context omitted.

'Git' is a preexisting word; it'd be pretty strange to pronounce it with a soft G. https://en.wiktionary.org/wiki/git#Etymology_1 https://en.wiktionary.org/wiki/git#Etymology_2 It'd be like naming your software fukr and then insisting "no no no, the R is pronounced 'are', not 'er'."

Git' is a preexisting word; it'd be pretty strange to pronounce it with a soft G. It certainly was when I heard it.

I work with a French guy who uses "szheet"

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#117

Post by SOLAR_FIELDS »

t0astbread wrote: post #113
SOLAR_FIELDS wrote: post #48

Earlier quoted context omitted.

So like SOPS, but specific to nix somehow? What is the advantage of the nixy integration here vs the universality of SOPS? Better native integration with NixOS?

To clarify maybe, NixOS puts all configuration and program files it handles in a world-readable object store on disk. If you want to manage secrets on NixOS securely, you have two choices: - Manage it out of band. That negates all of the benefits of NixOS, at least for those files. (I.e. you would need additional deployment steps, rollback wouldn't work, you would have to stop and migrate system services that depend…

I see. So you do need one of these libraries if you want to do things The Nix Way with secrets

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#118

Post by thaumasiotes »

nvy wrote: post #82
ljlolel wrote: post #43

Earlier quoted context omitted.

Or Coq?

Coq is pronounced exactly how it looks. It's the French word for rooster and for the language, comes from part of the guy's name.

> It's the French word for rooster

It's also the English word for rooster.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#119

Post by abdusco »

jjice wrote: post #78

It would be fantastic if Age (or at least something similar) could become standard on Unix machines. I'd love a more Unix-philosophy following tool than GPG/PGP to be around for encryption. That said, I don't think new standard tools for Unix machines are very common. The closest thing I can think of in the last while is `jq`, but it's not "preinstalled on your machine" kind of standard, just "my script might just us…

Could zipping the file with a password work as an encryption?

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#120

Post by r3mko »

qyckudnefDi5 wrote: post #100
FiloSottile wrote: post #15

_o/ hi all, age author here! age is the one of my projects that grew most organically into an ecosystem. It's always great to see what people build with it. Happy to answer any questions. Here are some previous discussions 132 points on Feb 26, 2023 | 77 comments | https://news.ycombinator.com/item?id=34936504 126 points on Sept 26, 2022 | 54 comments | https://news.ycombinator.com/item?id=32980141 113 points on June…

Have you considered writing passage in Go to integrate age and age-plugin-yubikey as a single binary to make it more convenient to setup and use?

Combining Passage, pass-otp, and age into a single Go app has actually been on my personal hobby-project TODO list (but I haven't gotten around to it yet).

Integrating age plugins into this binary is not something I would do, though. Besides the fact that the plugins are separate projects with their own release schedules, they are also in different languages (plugin-yubikey is Rust, plugin-se is Swift, ...), and you would need to fork them anyway for communication. I guess you could bundle the binaries together in a package, and make sure the search path searches for the bundled binaries as a fallback.

Post reply on HN