<story><title>Age – a simple, modern and secure file encryption tool, format, and Go library</title><url>https://github.com/FiloSottile/age</url></story><parent_chain><item><author>upofadown</author><text>Age is great and all but it has a huge footgun. It encourages the user to encrypt material with a public key in a way that is entirely unauthenticated. So an attacker with access to that public key can simply overwrite the file with whatever they want. If ensuring that you end up with the same stuff as you encrypted is important than that can be a big problem. Fixing this involves the use of a separate signing utility and thus introduces an entirely different set of keys for the user to manually manage.&lt;p&gt;By doing the key management for the user, GPG actually ends up being a lot more usable...</text></item></parent_chain><comment><author>woodruffw</author><text>I&amp;#x27;m not sure I understand this comment: age doesn&amp;#x27;t have authenticated encryption, but neither does PGP. The closest thing in PGP is the &amp;quot;Modification Detection Code,&amp;quot; which is hilariously broken[1].&lt;p&gt;Edit: On top of that, every PGP implementation that I&amp;#x27;ve ever worked with happily streams unauthenticated, decrypted plaintext before completing MDC verification.&lt;p&gt;[1]: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;latacora.micro.blog&amp;#x2F;2019&amp;#x2F;07&amp;#x2F;16&amp;#x2F;the-pgp-problem.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;latacora.micro.blog&amp;#x2F;2019&amp;#x2F;07&amp;#x2F;16&amp;#x2F;the-pgp-problem.html&lt;/a&gt;</text></comment>
<story><title>Age – a simple, modern and secure file encryption tool, format, and Go library</title><url>https://github.com/FiloSottile/age</url></story><parent_chain><item><author>upofadown</author><text>Age is great and all but it has a huge footgun. It encourages the user to encrypt material with a public key in a way that is entirely unauthenticated. So an attacker with access to that public key can simply overwrite the file with whatever they want. If ensuring that you end up with the same stuff as you encrypted is important than that can be a big problem. Fixing this involves the use of a separate signing utility and thus introduces an entirely different set of keys for the user to manually manage.&lt;p&gt;By doing the key management for the user, GPG actually ends up being a lot more usable...</text></item></parent_chain><comment><author>e12e</author><text>Wow, I just looked at the issues in the repo, and the position of the developers is indeed that there will be no signing - so you can verify the recipient, but never the sender.&lt;p&gt;So if I have your &lt;i&gt;public&lt;/i&gt; key, I can just replace all your backups for example - and age cannot help you detect that. (for the particular use-case of encrypt-to-self, one could use the authenticated symmetric encryption, rather than public key - and assume the pass phrase is kept secret). But then your backup client can both &amp;quot;read and write&amp;quot; your backups - rather than just encrypt (to your public key) and sign (with backup instance private key).&lt;p&gt;So you get.. 30% of the benefits of public key encryption, for 90% of the complexity?</text></comment>