Is a PGP-based password manager a good idea in 2019?

[Henrik Christian Grove]

Den 29/08/2019 kl. 15.36 skrev Allan Odgaard:
>
> On 29 Aug 2019, at 11:24, Sylvia Gough wrote:
>
>     [1]: https://latacora.micro.blog/2019/07/16/the-pgp-problem.html
>
> This article states that currently there is no good solution for
> single file encryption (beyond PGP), but links to |age| as something
> that may eventually become a replacement.
>
> The manual for |age| [1] mentions a password-store (|pass|) backend as
> a long-term goal :)
>
> [1]
> https://docs.google.com/document/d/11yHom20CrsuX8KQJXBBw04s80Unjv8zCg_A7sPAX_9Y/view
>

I agree, and also noted that when I read that article. But if one truly
wants to get rid of PGP, one might consider the passwords application
data and implement a password manager using libsodium (as recommended by
that article, but I think I've heard that recommended before) for them.
The result would probably end up quite far from the Unix philosophy,
that pass follows (and is part of why it's so loved), but I guess that
is an answer to the question in the subject, but then it's nowhere near
on-topic for this list.

And if you don't use the PGP keys for anything else (and the article -
probably, I haven't had the need for most of those cases, so I can't
claim to have tried - gives you good hints on how not to), there are no
real problems in using gpg for that.

But once an alternative for single file encryption becomes available,
I'm sure people will start thinking of porting pass to use that.

.Henrik