0

I recently learned about pass git integration, which allows to sync my passwords with a remote git repo. Which I instantly didn't hesitate to configure.

So then I decided to clone this repo on another computer (with another GPG key installed) and try to access the passwords. It however complained:

pass myaccount
gpg: decryption failed: no secret key

I guess that comes from the fact that I have another GPG key installed, not the one I encrypted my passwords with (I use the same GPG key ID though).

So, how do I access those passwords without transferring private GPG keys from the original machine to this one? I of course know the passphrase, and can transfer public ones if needed.

Or am I required to copy over the whole keyring?

Thoughts...

Now after writing this post, I think I'm closer to understanding how it works. So basically the keys I can find in ~/.gnupg aren't just keys - they are encrypted keys. Encrypted with the passphrase. And so it's relatively safe to copy them to another machine. Is it correct?

Improve this question

1 Answer 1

Reset to default
0

I still haven't tried it myself, but pass should be able to encrypt passwords for multiple GPG keys, so transfer the public key from the second computer to the first, and run pass init <id-of-GPG-key-1> <id-of-GPG-key-2>, then pass should encrypt all passwords in your store that aren't encrypted for those two keys for them, and (when synced, that's something git is good for) then they should be useable on both computers.

If you can't remember the id of the key that passwords are currently encrypted for, you can look in <password-store>/.gpgid.

Improve this answer
6
  • So, is it right that I need to have both public keys on both computers? (but private keys stay where they are)
    – WhiteBlackGoose
    Oct 12, 2022 at 7:04
  • Yes (as said I still haven't tried, but that's my understanding).
    – Henrik supports the community
    Oct 12, 2022 at 7:32
  • Hmm, thanks. But then every newly added device means I have to re-encrypt them all on all devices, right?
    – WhiteBlackGoose
    Oct 12, 2022 at 7:45
  • Alright, it works. I made a step-by-instruction
    – WhiteBlackGoose
    Oct 12, 2022 at 8:25
  • If I understand this right, when I am adding my 5th computer, so I'll have to go around all the other 4 to add to all of them my 5th public key? That also does not seem ideal. Also I have doubts that my Android pass client actually supports that. In my opinion the GPG keys are meant to be per physical person and not per machine. So personally, I send around with my single private key, protected by the passphrase. Once the key is installed on a particular device, so often the device offers some kind of secure storage that allows me to get rid of the passphrase locally.
    – user1182474
    Dec 17, 2022 at 17:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .