Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GPG-Tui, a Terminal User Interface for GnuPG

orhun.dev

Post reply on HN
Print view View original

71–80 of 105 posts

Re: GPG-Tui, a Terminal User Interface for GnuPG

#71

Post by throwaway45209 »

swiley wrote: post #69
beermonster wrote: post #51

Earlier quoted context omitted.

If you want to send something securely, I’m not sure email is the best method. Even if you understand all the risks and pitfalls and side-step the minefields it’s still insecure in non-fixable ways. ProtonMail make a service out if it mitigating those issues as best they can (but even they explain their threat-model and what they DON’T mitigate. Others such as Silent Circle ended up giving up. You could recommend to…

Signal is not secure if you're concerned about the App Store maintainer or Signal themselves having access to your data (you can't know what the contents of the app on the app store are and it my exfiltrate keys. This has been done with other similar apps in the past.)

// This has been done with other similar apps in the past.

Such as?

Re: GPG-Tui, a Terminal User Interface for GnuPG

#72

Post by zikduruqe »

doomrobo wrote: post #8
young_unixer wrote: post #5

Earlier quoted context omitted.

What do they use instead?

Standard replacements: For signing: signify/minisign For encryption: age For file transfer: magic wormhole For encrypted messaging: Signal (or your choice of e2e encrypted messaging platform)

Don’t forget, keys.pub for signing, encrypted messaging, and has wormhole in it

Re: GPG-Tui, a Terminal User Interface for GnuPG

#73

Post by cpach »

williamtwild wrote: post #70
cpach wrote: post #66

Earlier quoted context omitted.

As pointed out elsewhere in these threads there are now much better alternatives available. It’s time for PGP to retire.

With tour logic , Keurig exists so get rid of teapots? No thanks.

No need to get rid of good tools, such as teapots.

But PGP is simply not a good tool.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#74

Post by Siira »

cpach wrote: post #66
stingraycharles wrote: post #42

Earlier quoted context omitted.

For me the problem is that I use ssh way more often, so it’s easier to remember all the commands. I need to encrypt/decrypt something with GPG only a few times a year, and every time I struggle remembering the commands to do so.

As pointed out elsewhere in these threads there are now much better alternatives available. It’s time for PGP to retire.

What are these better tools?

Re: GPG-Tui, a Terminal User Interface for GnuPG

#75

Post by upofadown »

cpach wrote: post #64
upofadown wrote: post #53

Earlier quoted context omitted.

Signal is an instant messenger ... which is fine, but sometimes you really do need the extra security provided by an offline messaging solution like OpenPGP. The Cellebrite thing was a good example of this. Cellebrite doesn't get OpenPGP messages as they can and are usually protected by a passphrase. Cellebrite gets Signal messages.

In that case I would recommend Age. It’s a modern and sound replacement for GPG. https://age-encryption.org/

Not really. My opinion in some detail:

* https://articles.59.ca/doku.php?id=pgpfan:agevspgp

Age might be such a replacement some day for just the encryption function. But it has a ways to go. Actually defining the format would be a good first step.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#76

Post by upofadown »

imiric wrote: post #52
upofadown wrote: post #46

Earlier quoted context omitted.

Age is not even close to being some sort of GPG replacement: * https://articles.59.ca/doku.php?id=pgpfan:agevspgp

I don't think that's a fair comparison. Age was never meant to fully replace GPG, so complaining about missing features it was never meant to have doesn't make sense. The only valid criticism is about its handling of corrupted data, but for that too you can use an external tool like PAR2 to generate recovery data. I do this with my GPG backups and other data as well. I like that age follows the Unix "do one thing wel…

I am not sure how PAR2 helps here if your encryption utility refuses to return any data in the first place.

I was responding to a comment that said that age was a "standard replacement" for GPG.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#79

Post by creamytaco »

KirillPanov wrote: post #39
sneak wrote: post #22

Earlier quoted context omitted.

It's very hard to simply encrypt a file to a given pubkey (due to the key trust model) compared to, for example, something like age (where it's just `age -r $PUBKEY`). You also have to set GNUPGHOME somewhere and import the key first, you can't easily do it statelessly without tracking mud into the filesystem first.

I agree that age is a huge improvement over PGP, and the rightful heir to its throne. However most people complaining about PGP's UI go on to explain that this is why you should use Telegram or WhatsApp. That line of reasoning is just bogus.

Huge improvement? It doesn't even come close. It's yet another half-assed reimplementation of the easiest PGP features to reimplement. There is no web of trust, no smartcard support, not even signing.

Which is why age has gone nowhere, and pretty much everyone keeps using PGP.

Re: GPG-Tui, a Terminal User Interface for GnuPG

#80

Post by [deleted] »

tomcooks wrote: post #43
njt wrote: post #29

Earlier quoted context omitted.

> GPG exists, and no one has really proposed good solutions [...] > if you're going to complain please work towards solving the issue Perhaps because you are asking the wrong question: "PGP/GPG is old, broken, and insecure, what is an exact drop-in replacement that I can substitute for it?" Instead, the question should be: "PGP/GPG is old, broken, and insecure, what is a replacement for [this specific thing I am tryi…

GPG is broken and insecure‽

[deleted]
Post reply on HN