gnupg

I used to do one-password-per-gnupg-file with plain GnuPG commands, and liked it quite a bit.

But when I check my system: foo@bar:~$ gpg2 --version gpg (GnuPG) 2.0.22 libgcrypt 1.5.3 So I'm wondering why GnuPG 2.0.22 isn't using Libgcrypt 1.6.x?

Keybase links Mirimir's public GnuPG key to a few social accounts, and to an email address.

Using gnupg unfortunately requires a fairly complete understanding of the specific Web of Trust model used.

We also use gpg (gnupg.org) to encrypt our critical databases and code repository and send them to Amazon S3 every night.

I'm 100% sure OpenBSD is absolutely NOT fit for people who find GnuPG confusing enough to avoid usage.

GnuPG is complicated, the gpg(1) man page is quite extensive compared to signify.

But this is no more, only after public shaming did the Googles/Facebooks chip in money for OpenSSL and GnuPG when those projects almost collapsed.

Facebook is already using GnuPG keys to secure system messages to users.

Maybe a funding drive should happen like for gnupg...

I got back on GnuPG recently because an associate wouldn't communicate without it.

At least with x509/gnupg you can partner with someone like youbikey, and at least pretend to lower the ux friction and increase the real-world security of the system.

Self-signed X.509 certificates would have done more for the cause of "secure email" than all GnuPG advocacy ever did.

The paper states: "We have disclosed our attack to GnuPG developers under CVE-2014-3591, suggested suitable countermeasures, and worked with the developers to test them.

GnuPG 1.4.19 and Libgcrypt 1.6.3 (which underlies GnuPG 2.x), containing these countermeasures and resistant to the key-extraction attack described here, were released concurrently with the first public posting of these results." Basically that Libcrypt 1.6.3 underlies GnuPG 2.x.

If "technical people" can not setup a new GnuPG key in 20 minutes, they are obviously not "technical" in this context.