Re:Age: A simple, modern and secure file encryption tool
by globular-toast on Saturday December 28, 2019 @10:14AM
(#21899266)
So how do I send an email securely without PGP? I've never been aware of any real alternative. The problem is just that people don't care enough to use it.
[ Parent
| on HN ]
Re:Age: A simple, modern and secure file encryption tool
by brians on Saturday December 28, 2019 @11:54AM
(#21899938)
You don’t. But you don’t with PGP either: bad crypto primitive defaults, no header protection including From or Subject or Reply-to, bad typical UI showing up authenticated text/plain in with authenticated parts.
The case where I still use PGP is receiving reports of bugs from unaffiliated researchers, and I should replace it with a form on an HTTPS web site.
Re:Age: A simple, modern and secure file encryption tool
by upofadown on Saturday December 28, 2019 @02:43PM
(#21901213)
>no header protection including From or Subject or Reply-to
This is email, not IM we are talking about. There is no good way to do that without a lot of added complexity and hassle once the email ends up in your archive.
>bad crypto primitive defaults
If you mean forward secrecy then see the proceeding comment.
Re:Age: A simple, modern and secure file encryption tool
by UncleMeat on Saturday December 28, 2019 @11:38PM
(#21903977)
Its not forward secrecy. Its literally that the default ciphers and modes for PGP are a mess and it is so configurable that it is full of footguns.
Re:Age: A simple, modern and secure file encryption tool
by kjs3 on Saturday December 28, 2019 @03:29PM
(#21901507)
I'm missing the email header issues, unless I'm trusting PGP public keys without any thought. If someone forges an email to me, has a PGP encrypted message in it, it doesn't validly decrypt unless my crypto discipline is already so lax I'm going to have issues with any system.