Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Gpg.fail

gpg.fail

Post reply on HN
Print view View original

141–150 of 376 posts

Re: Gpg.fail

#141

Post by ghickPit »

cpach wrote: post #20
rurban wrote: post #2

Zero-days from the CCC talk https://fahrplan.events.ccc.de/congress/2025/fahrplan/event/... But trust in Werner Koch is gone. Wontfix??

To be frank, at this point, GPG has been a lost cause for basically decades. People who are serious about security use newer, better tools that replace GPG. But keep in mind, there’s no “one ring to rule them all”.

> To be frank, at this point, GPG has been a lost cause for basically decades.

Why do high-profile projects, such as Linux and QEMU, still use GPG for signing pull requests / tags?

https://docs.kernel.org/process/maintainer-pgp-guide.html

https://www.qemu.org/docs/master/devel/submitting-a-pull-req...

Why does Fedora / RPM still rely on GPG keys for verifying packages?

This is a staggering ecosystem failure. If GPG has been a known-lost cause for decades, then why haven't alternatives ^W replacements been produced for decades?

Re: Gpg.fail

#142

Post by [deleted] »

ghickPit wrote: post #141
cpach wrote: post #20

Earlier quoted context omitted.

To be frank, at this point, GPG has been a lost cause for basically decades. People who are serious about security use newer, better tools that replace GPG. But keep in mind, there’s no “one ring to rule them all”.

> To be frank, at this point, GPG has been a lost cause for basically decades. Why do high-profile projects, such as Linux and QEMU, still use GPG for signing pull requests / tags? https://docs.kernel.org/process/maintainer-pgp-guide.html https://www.qemu.org/docs/master/devel/submitting-a-pull-req... Why does Fedora / RPM still rely on GPG keys for verifying packages? This is a staggering ecosystem failure. If GPG h…

[deleted]

Re: Gpg.fail

#143

Post by jhgb »

akerl_ wrote: post #136
jhgb wrote: post #134

Earlier quoted context omitted.

> Use Signal. Or Wire, or WhatsApp, or some other Signal-protocol-based secure messenger. That's a "great" idea considering the recent legal developments in the EU, which OpenPGP, as bad as it is, doesn't suffer from. It would be great if the author updated his advice into something more future-proof.

There's no future-proof suggestion that's immune to the government declaring it a crime. If you want a suggestion for secure messaging, it's Signal/WhatsApp. If you want to LARP at security with a handful of other folks, GPG is a fine way to do that.

Nobody decided that it's a crime, and it's unlikely to happen. Question is, what do you do with mandatory snooping of centralized proprietary services that renders them functionally useless aside from "just live with it". I was hoping for actual advice rather than a snarky non-response, yet here we are.

Re: Gpg.fail

#144

Post by akerl_ »

jhgb wrote: post #143
akerl_ wrote: post #136

Earlier quoted context omitted.

There's no future-proof suggestion that's immune to the government declaring it a crime. If you want a suggestion for secure messaging, it's Signal/WhatsApp. If you want to LARP at security with a handful of other folks, GPG is a fine way to do that.

Nobody decided that it's a crime, and it's unlikely to happen. Question is, what do you do with mandatory snooping of centralized proprietary services that renders them functionally useless aside from "just live with it". I was hoping for actual advice rather than a snarky non-response, yet here we are.

I gave you the answer that exists: I'm not aware of any existing or likely-to-exist secure messaging solution that would be a viable recommendation.

The available open-source options come nowhere close to the messaging security that Signal/Whatsapp provide. So you're left with either "find a way to access Signal after they pull out of whatever region has criminalized them operating with a backdoor on comms" or "pick any option that doesn't actually have strong messaging security".

Re: Gpg.fail

#145

Post by akerl_ »

johnisgood wrote: post #132
cpach wrote: post #109

Earlier quoted context omitted.

Those people should perhaps ponder if it’s a reasonable thing to insist on using this broken standard/tool in 2025.

Yeah, well, I wish I could convince people to use 2-4 different tools when one does it "just fine".

I thought the whole unix philosophy was to have a bunch of tools that each do one thing well, and to compose them into the workflow you want.

Re: Gpg.fail

#146

Post by snorremd »

larusso wrote: post #35
oefrha wrote: post #33

Okay, since there’s so much stuff to digest here and apparently there are issues designated as wontfix by GnuPG maintainers, can someone more in the loop tell us whether using gpg signatures on git commits/tags is vulnerable? And is there any better alternative going forward? Like is signing with SSH keys considered more secure now? I certainly want to get rid of gpg from my life if I can, but I also need to make sur…

I did the switch this year after getting yet another personal computer. I have 4 in total (work laptop, personal sofa laptop, Mac Mini, Linux Tower). I used Yubi keys with gpg and resident ssh keys. All is fine but the configuration needed to get it too work on all the machines. I also tend to forget the finer details and have to relearn the skills of fetching the public keys into the keychain etc. I got rid of this…

I’ve ended up the same place as you. I had previously set up my gpg key on a Yubikey and even used that gpg key to handle ssh authentication. Then at some point it just stopped working, maybe the hardware on my key broke. 2FA still works though.

In any case I figured storing an SSH key in 1Password and using the integrated SSH socket server with my ssh client and git was pretty nice and secure enough. The fact the private key never leaves the 1Password vault unencrypted and is synced between my devices is pretty neat. From a security standpoint it is indeed a step down from having my key on a physical key device, but the hassle of setting up a new Yubikey was not quite worth it.

I’m sure 1Password is not much better than having a passphrase-protected key on disk. But it’s a lot more convenient.

Re: Gpg.fail

#147

Post by Fnoord »

jhgb wrote: post #143
akerl_ wrote: post #136

Earlier quoted context omitted.

There's no future-proof suggestion that's immune to the government declaring it a crime. If you want a suggestion for secure messaging, it's Signal/WhatsApp. If you want to LARP at security with a handful of other folks, GPG is a fine way to do that.

Nobody decided that it's a crime, and it's unlikely to happen. Question is, what do you do with mandatory snooping of centralized proprietary services that renders them functionally useless aside from "just live with it". I was hoping for actual advice rather than a snarky non-response, yet here we are.

> Nobody decided that it's a crime, and it's unlikely to happen.

Which jurisdiction are you on about? [1] Pick your poison.

For example, UK has a law forcing suspects to cooperate. This law has been used to convict suspects who weren't cooperating.

NL does not, but police can use force to have a suspect unlock a device using finger or face.

[1] https://en.wikipedia.org/wiki/Key_disclosure_law

Re: Gpg.fail

#148

Post by ekjhgkejhgk »

Is anyone else worried that a lot of people coming from the Rust world contribute to free software and mindlessly slap on it MIT license because it's "the default license"? (Yes, I've had someone say this to me, no joke)

GnuPG for all its flaws has a copyleft license (GPL3) making it difficult to "embrace extend extinguish". If you replace it with a project that becomes more successful but has a less protective (for users) license, "we the people" might lose control of it.

Not everything in software is about features.

Re: Gpg.fail

#149

Post by [deleted] »

woodruffw wrote: post #22
derleyici wrote: post #17

Werner Koch from GnuPG recently (2025-12-26) posted this on their blog: https://www.gnupg.org/blog/20251226-cleartext-signatures.htm... Archive link: https://web.archive.org/web/20251227174414/https://www.gnupg...

This feels pretty unsatisfying: something that’s been “considered harmful” for three decades should be deprecated and then removed in a responsible ecosystem. (PGP/GPG are of course hamstrung by their own decision to be a Swiss Army knife/only loosely coupled to the secure operation itself. So the even more responsible thing to do is to discard them for purposes that they can’t offer security properties for, which is…

[deleted]

Re: Gpg.fail

#150

Post by pabs3 »

arccy wrote: post #55
perching_aix wrote: post #47

Earlier quoted context omitted.

What are those better tools? I've been broadly looking into this space, but never ventured too deep.

ssh or minisign for signing age for file encryption

The gpg.fail page mentions minisign vulns too.
Post reply on HN