[Buttons840]

> The lesson is don't send passwords over slack.

I was going to make a suggestion about PGP or GPG or whatever, but those tools are so bad you can't expect software engineers to know how to use them... (not sarcasm)

Snark aside. What I mean here is that GPG is difficult to use and I would guess 90% of programmers don't know how to use it.

[VPenkov]

Is describing them as bad related to their ease of use or is it related to technical shortcomings?

I use PGP very frequently and I'd like to know what's bad about it so I could maybe look for alternatives.

[Buttons840]

You're right and I'm sorry. I should have explained my snarky comment fully.

I meant that they're difficult to use. I would love to be proven wrong or directed to some good resources for learning them.

[chlorion]

It's really not so bad. You use --genkey to generate a key, --import to import a key, --encrypt and --decrypt do what they say on the tin, --sign to sign messages, --recv-key can download a key from a keyserver and --verify to verify signatures. That's pretty much 99% of what I do with gpg! It behaves like a standard command line utility and can read from stdin and output to stdout if you need it to.

I hear that gpg is very difficult to use quite a lot but I have not had that experience at all. The flags are pretty self explanatory and the magpage(s) are very detailed!

There are also decent GUI interfaces that are extremely simple to operate! I would recommend "kleopatra" for most people! Emacs also works if you are into that!

[Buttons840]

How would I send my public key to someone?

[chlorion]

I'm not sure if you are asking how to export your public key or how to distribute it, so I guess I can mention both.

You can export your public key using the --export flag, by default it exports all public keys in the keyring, so you can pass a keyid to only export a specific key. If you need the exported key to be in text form (not just a binary file) you can pass the --armor flag as well. The --armor flag encodes the binary data with base64 or something which allows you to operate on it like you would any other text (copy/paste, send over email, etc).

As for distributing the key, it depends! Lots of people put their public key on their GitHub profile or somewhere on their website (if they have a website). Since we are on HN you could put it in the "about" field on your HN profile. If none of these work you can send it over telegram, signal or whatever your favorite messaging method is.

For most people and situations the TOFU (trust of first use) method of distribution works fine. If you have stronger security requirements or are more paranoid you can establish a more secure channel or try to meet with the other parties in person.

[aborsy]

GPG works fine for me too, and is fairly straightforward (except for email encryption, since my recipients often don’t want encryption, and there is also lack of good email clients supporting encryption).