2

Is it good/common practice to store the gpg private keys on my local machine, even if I intend to use them for pass, which obviously encrypts sensible data.

Is there a sensible alternative, like storing it on a usb stick?

I am on a Debian Buster Machine.

Edit: Please tell me if this question is misplaced here. I will remove it immediately

Improve this question
1
  • There are a number of hardware devices for storing keys. They tend to be much more secure than local storage, but local storage is very common.
    – user1794469
    Mar 10, 2020 at 20:22

1 Answer 1

Reset to default
4

Common practice ? Definitely.

Good practice ? It depends on your threat model and how sensitive the data you are trying to protect is.

I for example like to use PGP with smart cards and use a reader with a PINpad. Thus, a keylogger cannot steal the passphrase. If the computer is stolen, the subkeys are not stored locally. Then the risk of compromise of my PGP keys is low.

I also make sure to generate the keys on an airgapped computer with no network access and running a live distro like Tails, and I transfer them to the smart card immediately.

To sum up there are two things you need to protect: the private keys and the passphrase. A trojan installed on your machine can potentially obtain both.

Say your keys are stored on a laptop and it gets stolen. Assuming your laptop does not have an encrypted, disk, BIOS password or some kind of obstacle, the thief can gain access to the private keys but does not have the passphrase, although a brute-force attack is possible in theory.

Of course you can protect the laptop better, for example encrypt your partition with luks or another scheme, using a strong password that cannot be guessed easily. Then you make it difficult or downright impossible for the thief to compromise your secrets.

Yes, PGP keys should be well protected but good computer security hygiene does not stop there.

Improve this answer
1
  • First thank You. Since you seem knowledgable to the topic. Would you confidentely put you encrypted bank details in a git repository then? What I mean with that, is whether you as an end user, who handles the key(s) safely, can completely rely on this. Additionally to that (other than key creation), are there any more steps to take, or things you should know, when using pass safely. Other than the obvious?
    – larfan
    Mar 10, 2020 at 22:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .