21 years after the request OpenPGP support gets added to Thunderbird

Re:21 years after the request OpenPGP support gets added to ... by tptacek on Thursday September 17, 2020 @11:07PM (#24512577)

It's telling that the most common example of a widespread use of PGP (modern messaging applications exchange more messages in a day than OpenPGP has ever exchanged) is software update schemes, because software update cryptography is both a solved problem (just use signify) and doesn't have network effects; it's a "trust anchor" application.

At least with PGP email, you can make the argument that PGP sticks around because people don't want to recreate contact lists. But even that argument doesn't apply to update.

[ Parent | on HN ]

Re:21 years after the request OpenPGP support gets added to ... by somedude11 on Friday September 18, 2020 @02:20AM (#24513513)

Backup, archivization, password managers, the list is long. Duplicity has many users: http://duplicity.nongnu.org Pass is also pretty popular on HN: https://www.passwordstore.org Both use GPG.

[ Parent | on HN ]

Re:21 years after the request OpenPGP support gets added to ... by stormbrew on Friday September 18, 2020 @02:58AM (#24513745)

I use pass and I would switch in a heartbeat to a fork of it that used ssh keys or something similar instead of gpg. For something so amazingly simple and useful, its dependence on the klunky mess that is gpg key management is an anchor that weighs it down.

[ Parent | on HN ]

Re:21 years after the request OpenPGP support gets added to ... by somedude11 on Friday September 18, 2020 @03:30AM (#24513963)

Key management is a burden in every cryptosystem. I'm using KeePass and can recommend it, it works well.

[ Parent | on HN ]

Re:21 years after the request OpenPGP support gets added to ... by wglb on Friday September 18, 2020 @02:33PM (#24520294)

Would you know if it failed?

[ Parent | on HN ]

Re:21 years after the request OpenPGP support gets added to ... by somedude11 on Saturday September 19, 2020 @06:02PM (#24530601)

If it would "fail" and there would be no consequences so I could't tell if it failed or not - would it make a difference?

[ Parent | on HN ]

Re:21 years after the request OpenPGP support gets added to ... by wglb on Sunday September 20, 2020 @08:10PM (#24538520)

If the failure were discovered by you a year later, realizing that all you thought was protected was in an adversary's hands.

I'm suggesting that "seems fine so far" is not effective at evaluating solidity of cryptographical usage.

[ Parent | on HN ]

Re:21 years after the request OpenPGP support gets added to ... by trishankdatadog on Thursday September 17, 2020 @11:49PM (#24512799)

> software update cryptography is both a solved problem (just use signify)

Well, just use TUF [1] and in-toto [2] ;)

[1] https://theupdateframework.io/

[2] https://in-toto.io/

[ Parent | on HN ]

Re:21 years after the request OpenPGP support gets added to ... by theamk on Friday September 18, 2020 @04:13PM (#24521403)

Note that TUF is great for things with multiple contributiors (think npm or pypa).

For the simple case of "a single publisher publishes update for a single product", TUF is an overkill. Something like signify or seccure will be way easier to set up and use.

[ Parent | on HN ]

Re:21 years after the request OpenPGP support gets added to ... by trishankdatadog on Monday September 21, 2020 @02:11PM (#24546574)

signify is nice when key distribution, revocation, and rotation is handled for you... but how do you do that securely for many different publishers on a single repo?

[ Parent | on HN ]