Gopass: Open-source command-line password manager for teams
Gopass is an open-source command-line password manager that stores GPG-encrypted secrets in git.
Stories per day · 30 days
1 RSS
8 stories, newest first · one card per story
Stories tagged #gpg
Re: Retrospective by 'gpg.fail' authors
oss-security follow-up to a gpg.fail authors' retrospective argues that GnuPG's unmaintained, forgotten code is a security liability and should be deleted.
Re: Retrospective by 'gpg.fail' authors
GnuPG maintainer Werner Koch responds on oss-security to a gpg.fail retrospective covering 2003-era GnuPG code.
Re: Retrospective by 'gpg.fail' authors
Sam James replies to GnuPG author Werner Koch that upstream may freely adopt stricter -W compiler warnings, while distros should avoid blanket -Werror.
Re: Retrospective by 'gpg.fail' authors
GPG exploitation talk author clarifies a format-string 0day enabling code execution via printf %n writes and a polyglot PEM certificate payload.
Re: Retrospective by 'gpg.fail' authors
Peter Gutmann replies to gpg.fail retrospective, pointing to PGP's arbitrary packet format as root of many past vulnerabilities.
Retrospective by 'gpg.fail' authors
Authors of the gpg.fail GnuPG vulnerability set published a retrospective with talk recording, slides, and a repo PoC.
The gpg.fail aftermath: On responsible disclosure, GPG, and the state of security in 2026 [32:37]
A conference talk recounts GPG vulnerability disclosures, notes several GnuPG flaws remain unpatched, and demonstrates novel bugs live.