Re: On the security of ~/.password-store/.gpg-id [was: Re: Second OpenPGP-card]

2024-03-02 Thread Werner Koch via Gnupg-users
On Fri, 1 Mar 2024 21:56, Daniel Kahn Gillmor said: > For example, GnuPG could instead offer an interface with explicit > options to allow the user to choose to match certificates by > fingerprint, or by e-mail address, or by name, or by full User ID, but Simply prefix the fingerprint with 0x

Re: On the security of ~/.password-store/.gpg-id [was: Re: Second OpenPGP-card]

2024-03-01 Thread Jay Acuna via Gnupg-users
On Fri, Mar 1, 2024 at 8:57 PM Daniel Kahn Gillmor via Gnupg-users wrote: > I agree with you that it's nice to refer to people by human-memorable > names. I just wish it was safe to do so. I would consider it is safe to do so. It is in fact mostly the entire purpose of GPG to identify the

Re: On the security of ~/.password-store/.gpg-id [was: Re: Second OpenPGP-card]

2024-03-01 Thread Daniel Kahn Gillmor via Gnupg-users
On Fri 2024-03-01 17:06:09 +0100, Ingo Klöcker wrote: > On Donnerstag, 29. Februar 2024 21:21:42 CET Daniel Kahn Gillmor wrote: >> human-readable names for certificates. But i don't see how to use that >> safely while dealing with GnuPG's risky implementation choices here. > > Allowing recipients

Re: On the security of ~/.password-store/.gpg-id [was: Re: Second OpenPGP-card]

2024-03-01 Thread Ingo Klöcker
On Donnerstag, 29. Februar 2024 21:21:42 CET Daniel Kahn Gillmor wrote: > human-readable names for certificates. But i don't see how to use that > safely while dealing with GnuPG's risky implementation choices here. Allowing recipients to be specified by email address (or some other part of a