Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this community
Is it good/common practice to store the gpg private keys on my local machine, even if I intend to use them for pass, which obviously encrypts sensible data.
Is there a sensible alternative, like storing it on a usb stick?
I am on a Debian Buster Machine.
Edit: Please tell me if this question is misplaced here. I will remove it immediately
Common practice ? Definitely.
Good practice ? It depends on your threat model and how sensitive the data you are trying to protect is.
I for example like to use PGP with smart cards and use a reader with a PINpad. Thus, a keylogger cannot steal the passphrase. If the computer is stolen, the subkeys are not stored locally. Then the risk of compromise of my PGP keys is low.
I also make sure to generate the keys on an airgapped computer with no network access and running a live distro like Tails, and I transfer them to the smart card immediately.
To sum up there are two things you need to protect: the private keys and the passphrase. A trojan installed on your machine can potentially obtain both.
Say your keys are stored on a laptop and it gets stolen. Assuming your laptop does not have an encrypted, disk, BIOS password or some kind of obstacle, the thief can gain access to the private keys but does not have the passphrase, although a brute-force attack is possible in theory.
Of course you can protect the laptop better, for example encrypt your partition with luks or another scheme, using a strong password that cannot be guessed easily. Then you make it difficult or downright impossible for the thief to compromise your secrets.
Yes, PGP keys should be well protected but good computer security hygiene does not stop there.
