Age: A simple, modern and secure file encryption tool

Re:Age: A simple, modern and secure file encryption tool by brians on Saturday December 28, 2019 @11:54AM (#21899938)

You don’t. But you don’t with PGP either: bad crypto primitive defaults, no header protection including From or Subject or Reply-to, bad typical UI showing up authenticated text/plain in with authenticated parts.

The case where I still use PGP is receiving reports of bugs from unaffiliated researchers, and I should replace it with a form on an HTTPS web site.

[ Parent | on HN ]

Re:Age: A simple, modern and secure file encryption tool by upofadown on Saturday December 28, 2019 @02:43PM (#21901213)

>no header protection including From or Subject or Reply-to

This is email, not IM we are talking about. There is no good way to do that without a lot of added complexity and hassle once the email ends up in your archive.

>bad crypto primitive defaults

If you mean forward secrecy then see the proceeding comment.

[ Parent | on HN ]

Re:Age: A simple, modern and secure file encryption tool by UncleMeat on Saturday December 28, 2019 @11:38PM (#21903977)

Its not forward secrecy. Its literally that the default ciphers and modes for PGP are a mess and it is so configurable that it is full of footguns.

[ Parent | on HN ]

Re:Age: A simple, modern and secure file encryption tool by kjs3 on Saturday December 28, 2019 @03:29PM (#21901507)

I'm missing the email header issues, unless I'm trusting PGP public keys without any thought. If someone forges an email to me, has a PGP encrypted message in it, it doesn't validly decrypt unless my crypto discipline is already so lax I'm going to have issues with any system.

[ Parent | on HN ]