Differences

This shows you the differences between two versions of the page.

--- pgp_workshop [2025/05/29 07:47] – [The actual Key signing] usera
+++ pgp_workshop [2026/07/16 12:37] (current) – [Signing and verifying signatures with OpenPGP] usera
@@ Line 1: / Line 1: @@
 ====== PGP Workshop ======
+<aside outline box>
+**Important note on PGP:** PGP has been more and more criticized in the security community over the years (see for example [[https://www.latacora.com/blog/2019/07/16/the-pgp-problem/|here]] and [[https://soatok.blog/2024/11/15/what-to-use-instead-of-pgp/| here]]) for its complexity and flawed design. Therefore, it is not really a good idea to use PGP for sending ourselves encrypted mails, as opposed to use Signal (until some other better protocol is ready). As PGP is still quite used for signing packages, it can still be a good idea to learn it for verifying those packages.
+</aside>
 Here is a small tutorial for getting started with this protocol named Pretty Good Privacy (PGP), an asymmetric cryptographic tool that allows to have end to end encrypted mails despite using very mainstream services like gmail, outlook, etc. You will find several names around, like GPG, PGP, OpenPGP. I will use them interchangeably as they basically refer to the same thing.
@@ Line 167: / Line 171: @@
 The way it is done is the following:
-  - The file is **[[hashed|hashed]]** (see the paragraph below).
+  - The file is **[[hashed|hashed]]**.
   - This hashed file is encrypted with your private key
   - The result is added at the end of your file, giving a **signed** file.