from Hacker News

Ask HN: In Emacs, is there an alternative to GPG encryption in Org Mode?

by timetosleep on 6/25/21, 1:50 PM with 38 comments

It's GPG is starting to show it's age, Debian abandoning it for signing packages and it's general lack of usage.

Was wondering how one could probably use https://github.com/FiloSottile/age or something.

(Not an emacs pro, so sure don't know some of the trivial ways to use this)

  • by olivierestsage on 6/25/21, 3:00 PM

    A good place to ask questions like this is the (very friendly) Emacs subreddit.[1]

    [1] https://reddit.com/r/emacs

  • by upofadown on 6/25/21, 3:31 PM

    >Debian abandoning it for signing packages and it's general lack of usage.

    This is not true. There was a proposal near the start of the year. That proposal has been almost entirely ignored.

    Would age provide any advantage over GnuPG to make it worth the bother to switch to a new message format?

    * https://articles.59.ca/doku.php?id=pgpfan:agevspgp

  • by CyberShadow on 6/25/21, 2:34 PM

    If you have gnupg installed, emacs can just open foo.org.gpg files directly. It decrypts on load and re-encrypts on save.

    Probably you would get better answers about Emacs on https://emacs.stackexchange.com/ or https://www.reddit.com/r/emacs/ .

  • by creamytaco on 6/25/21, 4:21 PM

    GPG isn't going anywhere and Debian is not abandoning it.

    EasyPG is very mature in Emacs, makes using GPG a breeze and is integrated really well. Age doesn't even support signing and has no Emacs integration.

  • by beermonster on 6/25/21, 4:07 PM

    Have Debian abandoned it? Official reference to that fact if you have it would be nice.

    I’m aware of the wiki article but that’s not any official position. In the very least anyone can edit that wiki.

  • by qbasic_forever on 6/25/21, 5:59 PM

    Why not keep the notes in a VeraCrypt/TrueCrypt drive/partition? You can sidestep all the gpg complexity, and you get a little better protection since note filenames won't even be visible (and if you're really paranoid you can entirely obfuscate and hide the encrypted drive in unused partition space).

    Or just tick on the full disk encryption option in your OS (assuming it's a modern one like Win 10, recent Ubuntu, etc.). It's just as good at keeping your data protected at rest as any other encryption option you can run in userspace, and there's less chance of some file operation snafu accidentally unencrypting or leaking your data.

  • by forgotmypw17 on 6/25/21, 10:07 PM

    GPG-PGP works well,

    has tooling on pretty much every platform,

    is a mature, well-established product.

    The complicated features are optional.

    Using something like age, with one reference implementation in Go, not supported by most languages, nor time-tested, is just asking for trouble, like surprise exploits or bitrot making your data unusable.

    I am perplexed by the frequency of "PGP/GPG is old, let's replace it with something new and untested" posts on HN...

    In software development, OLD is GOOD.

    (As a side note, I don't think Debian has been at the forefront of rational decisionmaking for a while, so I wouldn't watch them too closely.)

  • by hprotagonist on 6/25/21, 2:36 PM

    come ask on libera in #emacs

  • by exikyut on 6/25/21, 3:27 PM

    Orthogonal question: where can I learn more about Debian abandoning GPG?