Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Age is a simple, modern and secure file encryption tool, format, and Go library

github.com

Post reply on HN
Print view View original

41–50 of 137 posts

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#41

Post by sharperguy »

e3bc54b2 wrote: post #3

Age (and its rust implementation Rage) combined with agenix[0] and age.el[1] has made my self-hosted deployment and management so, so easy without compromising security. That, when combined with general NixOS conveniences is why I'm able to self-host at all. If not for these, just the anxiety of having to setup new server in case of whatever loss and the associated time/opportunity loss kept me from dong the same for…

I have been using agenix and it is very helpful. I am also looking into writing a system module that makes it easy to generate secrets on the fly.

A lot of secrets are just things like, backend and frontend of some service need to be configured with matching keys, but are both running on the same device. In that case you could have a systemd service which just generates a new random key if it doesn't already exist, and then ensure that the dependent services wait for that service to complete. That way you don't have to store anything in git for those at least.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#42

Post by amluto »

lrvick wrote: post #14

For someone that never ever needs signing or authentication, including for ones own backups, who never has malware in their threat model, and trusts this specless tool will be maintained forever, maybe this makes sense? Even then openssl or sq can solve the problem in the same number of commands but with sntabdards. Most people are best off going with a modern implementation of the PGP standard, ideally via a smart c…

> Even then openssl or sq can solve the problem in the same number of commands but with sntabdards.

Using OpenSSL to properly encrypt a file is next to impossible, and if you actually succeed at doing so, you’re very unlikely to be following a defined standard.

I’m not familiar with sq.

> modern implementation of the PGP standard

The PGP standard is an unmitigated disaster.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#43

Post by ljlolel »

thaumasiotes wrote: post #38
kitd wrote: post #10

> The author pronounces it [aɡe̞] with a hard g, like GIF Lol, or 'git' according to one of my more sensitive colleagues.

'Git' is a preexisting word; it'd be pretty strange to pronounce it with a soft G. https://en.wiktionary.org/wiki/git#Etymology_1 https://en.wiktionary.org/wiki/git#Etymology_2 It'd be like naming your software fukr and then insisting "no no no, the R is pronounced 'are', not 'er'."

Or Coq?

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#44

Post by dpatterbee »

lrvick wrote: post #14

For someone that never ever needs signing or authentication, including for ones own backups, who never has malware in their threat model, and trusts this specless tool will be maintained forever, maybe this makes sense? Even then openssl or sq can solve the problem in the same number of commands but with sntabdards. Most people are best off going with a modern implementation of the PGP standard, ideally via a smart c…

> trusts this specless tool will be maintained forever

As per the third sentence of the readme there indeed is a spec[0]. There is also an alternative implementation in the form of rage[1], as well as numerous others listed on the awesome-age page[2].

[0]: https://github.com/C2SP/C2SP/blob/main/age.md

[1]: https://github.com/str4d/rage

[2]: https://github.com/FiloSottile/awesome-age

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#45

Post by klabb3 »

quectophoton wrote: post #22
klabb3 wrote: post #21

Earlier quoted context omitted.

Meh. The author of age is very experienced and known specifically for security, crypto and within the implementation language (Go). Audits are only as good as the competence of the auditors and can often turn into checklist rituals. It certainly doesn’t hurt, but audits are not a panacea.

Agreed, but IMHO claiming that a crypto library is secure without providing independent verification, is like claiming something is fast without providing benchmarks. (And both are the same in the sense that neither is a panacea.) I'm only bringing up audits because such claim was made, but maybe I should have said "independent verification" instead since it's more general.

Sure, I think we agree in semantics but the wording is difficult. The bar for secure you’re referring to is quite high, a lot of commercial products that brand themselves secure would be much less secure than something like age. These days I think it’s fair to use “secure” in the sense of “made a serious effort to provide certain security properties”. It’s too hard to define, let alone agree, to what secure should mean for everyone.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#46

Post by Retr0id »

lrvick wrote: post #14

For someone that never ever needs signing or authentication, including for ones own backups, who never has malware in their threat model, and trusts this specless tool will be maintained forever, maybe this makes sense? Even then openssl or sq can solve the problem in the same number of commands but with sntabdards. Most people are best off going with a modern implementation of the PGP standard, ideally via a smart c…

Age is not specless.

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#47

Post by samatman »

quectophoton wrote: post #19

The description claims it's "secure", but nothing pops up in the README when I Ctrl+F `audit`. So maybe take the "secure" claims with a grain of salt.

The description claims these curves are "safe" but nothing pops up when I Ctrl+F `audit`. https://safecurves.cr.yp.to

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#48

Post by SOLAR_FIELDS »

sharperguy wrote: post #40
ggpsv wrote: post #9

Earlier quoted context omitted.

Can you elaborate on how age (and the downstream packages) has made a difference in your workflows?

With agenix, you can encrypt your secrets, such as API keys, and have them stored in your git repo alongside the system configuration (which in nixos is just a bunch of text files). Then you only need to provision the server with the ed25519 private key corresponding to the pubkey the files were encrypted with, and agenix will automatically decrypt the files on boot and place them in /run/agenix, with the specified a…

So like SOPS, but specific to nix somehow? What is the advantage of the nixy integration here vs the universality of SOPS? Better native integration with NixOS?

Re: Age is a simple, modern and secure file encryption tool, format, and Go library

#49

Post by [deleted] »

ljlolel wrote: post #43
thaumasiotes wrote: post #38

Earlier quoted context omitted.

'Git' is a preexisting word; it'd be pretty strange to pronounce it with a soft G. https://en.wiktionary.org/wiki/git#Etymology_1 https://en.wiktionary.org/wiki/git#Etymology_2 It'd be like naming your software fukr and then insisting "no no no, the R is pronounced 'are', not 'er'."

Or Coq?

[deleted]
Post reply on HN