Hacker News Reader

Comment by pointlessone | Hacker News Reader

You don't have to reuse your keys. You can have a separate key(s) for signing.

The only reason the article gives for using this over using the signing with GPG keys is that you will have an SSH key already. If you need to create a new key, are there any reasons for going for an SSH key over a GPG key?

Because you are already acustomed to ssh?

I personaly use GPG. However, GPG looks complex and the ergonomics of GnuPG cli is horrible.

So use some GUI?

CLI ergonomic around working with ssh keys and ssh certificates is not great either.

And GPG/PGP at least has some standards around key distribution, web of trust, subkeys, etc.

I use GPG Suite on Mac and even then the ergonomics are confusing. GPG/PGP is just kind of confusing for us not deeply into cryptography.

I looked up the screenshots. The app looks like the most trivial possible UI for basic public key cryptography. Just a basic list of your/other people's keys (pretty much a contact list) and some ways to acquire them.

SSH keys if used in place of GPG would have almost the same UI. It's not the problem of GPG, but of the underlying concepts.

You don't need to be deep into cryptography, just understand some basic concepts from the wikipedia article, or whatnot.

The real reason is: I don't gain any security from signing my own commits, I gain security when other people sign their commits which they are currently not doing.

Therefore, making things easier to set up makes a greater contribution to security than strict, gold-standard security features that nobody adopts.

You don't gain any security if you can't verify the signatures of the others.

Reply on news.ycombinator.com