Hacker News Reader

Comment by lrvick | Hacker News Reader

For someone that never ever needs signing or authentication, including for ones own backups, who never has malware in their threat model, and trusts this specless tool will be maintained forever, maybe this makes sense?

Even then openssl or sq can solve the problem in the same number of commands but with sntabdards.

Most people are best off going with a modern implementation of the PGP standard, ideally via a smart card to protect you from key exfil via malware.

Tools like Keyfork, Sequoia, and/or openpgp-card-tool are almost certainly what you want for most personal signing, encryption, and authentication use cases.

You get broad compatibility with many many different tools.

View on HN

> trusts this specless tool will be maintained forever

As per the third sentence of the readme there indeed is a spec[0]. There is also an alternative implementation in the form of rage[1], as well as numerous others listed on the awesome-age page[2].

[0]: https://github.com/C2SP/C2SP/blob/main/age.md

[1]: https://github.com/str4d/rage

[2]: https://github.com/FiloSottile/awesome-age

Age uses standard (and modern) cryptography, and is itself standardized[1].

This is in contrast to the PGP ecosystem, which is infamously fragmented and insistent on maintaining support for insecure and home-baked schemes (e.g. 4880’s weird custom CFB mode). Sequoia has made some progress on the UX side of things, but PGP is a dead horse as far as modern, even conservative cryptographic software design goes.

[1]: https://github.com/C2SP/C2SP/blob/main/age.md

> Even then openssl or sq can solve the problem in the same number of commands but with sntabdards.

Using OpenSSL to properly encrypt a file is next to impossible, and if you actually succeed at doing so, you’re very unlikely to be following a defined standard.

I’m not familiar with sq.

> modern implementation of the PGP standard

The PGP standard is an unmitigated disaster.

> I’m not familiar with sq.

The reimplantation of PGP as a clean rust implantation with a simple cli (sq) is imnho quite exiting:

https://sequoia-pgp.gitlab.io/sq-user-guide/

I do think perhaps it's too little too late - bit in contrast with age it does provide for signing and authentication as well as simple(-ish) key/certificate management.

Age is not specless.

Reply on news.ycombinator.com