Hacker News new | ask | show | jobs
by worldsavior 1270 days ago
FYI, gpg is soon considered insecure, even now.
3 comments

You can’t make a statement like that without clarifying what you mean and sharing some alternative to gpg
It's less about the algorithm, but more how gpg/pgp is constructed/used. No forward secrecy, leaks info, bad text authentication, and other. Those things maybe can be fixed, but they're not.

https://latacora.micro.blog/2019/07/16/the-pgp-problem.html

Edit: an alternative for file encryption is age, fast simple and secure. Signing is signify.

What would you recommend, NaCl? Signify?
I would recommend using signify. That's what security researchers also recommend. Simple and elegant tool, designed to only signing, unlike gpg which is used for encrypting and signing as well.
lol