[prev in list] [next in list] [prev in thread] [next in thread] 

List:       gnupg-users
Subject:    Re: On the security of ~/.password-store/.gpg-id [was: Re: Second OpenPGP-card]
From:       Ingo =?ISO-8859-1?Q?Kl=F6cker?= <kloecker () kde ! org>
Date:       2024-03-01 16:06:09
Message-ID: 1883763.tdWV9SEqCh () daneel
[Download RAW message or body]

[Attachment #2 (multipart/signed)]


On Donnerstag, 29. Februar 2024 21:21:42 CET Daniel Kahn Gillmor wrote:
> human-readable names for certificates.  But i don't see how to use that
> safely while dealing with GnuPG's risky implementation choices here.

Allowing recipients to be specified by email address (or some other part of a 
user ID) was inherited from PGP. And I guess it's part of the reason for the 
success of PGP (and GnuPG) that one could specify keys of recipients by email 
addresses instead of by hard to remember key IDs (when those could still be 
considered unique) or by impossible to remember fingerprints (or by file name as 
sequoia-pgp seems to prefer).

Calling this a risky implementation choice of GnuPG is ridiculous. If anything 
then it's a risky implementation choice of pass to allow using anything other 
than a fingerprint in ~/.password-store/.gpg-id.

Regards,
Ingo

["signature.asc" (application/pgp-signature)]

_______________________________________________
Gnupg-users mailing list
Gnupg-users@gnupg.org
https://lists.gnupg.org/mailman/listinfo/gnupg-users


[prev in list] [next in list] [prev in thread] [next in thread]