An Advanced Intro to GnuPG | Hacker News Reader

An Advanced Intro to GnuPG

begriffs.com

177 pointssr222 comments

I still don't understand the state of hardware tokens. Everyone hates Yubikey, but the closest alternative available is Nitrokey which doesn't even come close to the form factor, or support U2F in their most expensive key option.

Now I learn there's something called GnuK but Google leads me to an obscure doc on building it yourself.

Until there are better options out there, I guess I'll stick to my Yubikey NEO

This is not my experience at all.. Most people I talk to about this loves their Yubikeys including myself.

I guess they have gotten a lot of flack for not being fully open source but in my experience most people are OK with this.

That's what I meant. From what I can recall on HN articles in the past, they hate them because it's closed source. Even this article says they're bad.

Yubikey originally supported an open source applet that ran on a proprietary runtime. A positive for this partially open source approach was that a serious bug was found in the applet (PIN bypass) and they had to do a recall. They have since switched to 100% proprietary.

https://developers.yubico.com/ykneo-openpgp/SecurityAdvisory...

I think they catch more flack because of the switch than they would have if they had been completely proprietary the entire time! (Even though the original open source applet couldn't be trusted completely since it ran on a proprietary runtime, the same way many do not trust open source Android software on phones due to proprietary cellular hardware.)

https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...

I have a yubikey 4 and a nitrokey and I use the former on a daily basis (and the nitrokey as a backup). The yubikey is faster and feels sturdier without needing a cap.

That being said I think the main objection to the yubikey is that they're using closed source software on the key. I'm not sure I really get the objection to be honest, in the end even if the soft is open source you have to trust them to actually flash that software on the key and not inserting hardware backdoors in the first place.

I highly recommend to every power user out there to get a GnuPG smartcard. It's convenient, secure, you can use it to sign and/or encrypt anything (email, files, passwords, git commits...), you can use it as an SSH key through GPG agent etc... It's well worth the ~50 euros it costs for the peace of mind it provides.

Hopefully it'll make PGP more popular and make it possible to actually send encrypted emails. I can't remember the last time I've received one myself...

That's what I use my Yubikey for! And it comes with U2F. I couldn't be happier!

After going back and forth on whether I wanted a Yubikey, I finally decided I didn't want to support them due to the closed sourceness.

I bought an Open PGP Card instead! https://www.g10code.com/p-card.html

You still have to buy your own card reader, and any card readers on the market aren't as small as the Yubikey... but it's a fantastic device and I love mine to death.

Note: the yubikey actually uses the open pgp card inside of it (which the actual implementation from the chip supplier is hardware-closed-source, although the reference architecture is open). The nitrokey too. They technically all have closed source with the BasicCard that runs inside them! With that in mind the secret-sauce of the yubikey is also closed source, where there's no secret sauce around your OpenPGP Card to be closed source.

That's sound advice but I'd like to point out that this Open PGP card appears to only support 2048bit keys while some (but not all!) yubikeys and nitrokeys support 4096bit.

I suppose nowadays 2048bit is more than enough but I like the extra safety and "future-proofness" of a 4096bit key.

I'm definitely with you, and don't advocate for 2048 bit keys anymore. That being said...

The older versions of the card only supported 2048bit keys. The 2.0 version and above support 4096 :)

I personally generated my RSA4096bit key on the card!

Most (but not all) code of the OpenPGP Card (for BasicCard) is available as open source and can be downloaded here: http://g10code.com/p-card.html

Open source (-ish?) Yubikey alternatives

https://sc4.us/hsm/ $75 | https://news.ycombinator.com/item?id=12053181

https://trezor.io/ $99 | https://news.ycombinator.com/item?id=10795087 (not much on HN)

https://www.floss-shop.de/en/security-privacy/13/openpgp-sma... €16.40 (OpenPGP Smart Card v2.1; 4096-bit keys)

https://www.fidesmo.com/fidesmo/about/privacy-card/ €15 (NFC only; recommended by the terminated SIGILANCE OpenPGP Smart Card project; 2048-bit keys)

The Mooltipass is intended for passwords but may support reading and writing small binary blobs, eg. encryption keys. AFAIK (as of August 2016) it wouldn't attempt to protect the private key / implement encryption.

https://www.themooltipass.com/ $79 | https://news.ycombinator.com/item?id=11983563

For GnuPG I use this hardware: https://begriffs.com/posts/2017-05-17-linux-workstation-guid...

For U2A two-factor auth I use a little Yubikey that is dedicated just for that and fits comfortably on a keychain. https://www.yubico.com/products/yubikey-hardware/fido-u2f-se...

Formfactor of the Yubikey is smaller but it lacks a full USB plug so that it might disconnect on old or loose USB ports.

GnuPG Fundraising Rally https://gnupg.org/donate/

GPG is still incredibly useful for me, if only for SSH keys on a YubiKey smart card. I need to get better at code signing on FOSS projects.

Pass [0] is also incredibly useful. Also Facebook and many Bitcoin exchanges can PGP encrypt sent emails.

[0]: https://www.passwordstore.org/

Actually it's very easy if you use git, just 2 lines of config.

  git config --global user.signingkey <your_pub_here>
  git config --global commit.gpgsign true

That's not the hard part. The hard part is getting keys moved around, expiry updated, subkeys handled—maybe having one key on the Yubikey helps with this, but I think sublet expiration is still going to be a problem.

Yup. By signing releases / commits with a particular key you're committing to maintaining possession and security of the key over the long term. For someone that loses their house key about 3 times a year, this is a big deal!

I'd like to see more of this covered in beginning legal CS and IS education.

Is GPGME, mentioned in this video, now libgcrypt, or is that something different?

I thought GnuPG was so last year?

Reply on news.ycombinator.com