Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It’s used for more than just email. For example, you can sign packages on for Pacman on Arch Linux with GPG (https://wiki.archlinux.org/title/Pacman/Package_signing), and they have you configure public key servers, which includes openpgp. Now, if I had set that up for package signing and other personal uses (like SSH keys, git commit signing, etc), that doesn’t mean I have my email set up to be encrypted.

You should 100% be able to set a flag on the key server what you are set up to automatically receive using the key.



There is a key for encryption, signing, authentication and certification in OpenPGP. The flags are C, E, S, A. The use cases are separate.

Perhaps another flag for automatic vs non automatic would help.


Encryption is not just for encrypted emails.


In theory. In practice, published PGP encryption subkeys has only seen adoption in emails.

Besides, is the criticism that people are using published keys for email? It seems people are outraged that they received encrypted data using keys that they themselves advertised. The specific medium for data transfer doesn’t seem to matter here.


There are separate flags for communications (like email) and storage (like files).

https://datatracker.ietf.org/doc/html/rfc4880#section-5.2.3....


Great, but while the encryption vs signing choice is presented by common software (albeit in a way that does not make this consequence clear), it completely does not present the encrypt for communication and encrypt for storage options.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: