GPG Key Managing
Hey guys, I wanted to ask you how you manage your gpg keys? Having them in plaintext all the time on my hard drive feels unsecure.
I have my ssh keys in a password manager (KeePassXC) that only exposes them to the keyagend, when unlocked. Do you know if something like that exists for pgp too?
like this
Mark
in reply to Zenlix • •Linux reshared this.
hummingbird
in reply to Zenlix • • •Zenlix
in reply to hummingbird • • •splendid9583 likes this.
HM King Charles III DG FD
in reply to Zenlix • • •HM King Charles III DG FD
in reply to Zenlix • • •MonkderVierte
in reply to Zenlix • • •coolie4
in reply to Zenlix • • •SMillerNL
in reply to Zenlix • • •The PGP problem
Latacoralike this
splendid9583 likes this.
splendid9583
in reply to SMillerNL • • •This is very interesting information!
I'd like to note that it's likely that several recommendations used as examples have been superseded with information around privacyguides.org/en/real-time… and similar locations, since expressing "use WhatsApp" makes me suspicious (and "use Wire" does not make me more confident): makeuseof.com/why-i-dont-trust… proton.me/blog/is-whatsapp-saf…
WhatsApp Is Secure Than Ever but I Don’t Trust It
Alvin Wanjala (MakeUseOf)like this
splendid9583 likes this.
SMillerNL
in reply to splendid9583 • • •The link I posted focuses on security, what you post focuses on privacy. Wire is a very secure protocol but WhatsApp being owned by Meta still makes it a privacy nightmare.
Signal is probably a better choice in that case.
splendid9583 likes this.
splendid9583
in reply to SMillerNL • • •It seems that the people managing privacyguides.org believe that "Balancing security, privacy, and usability is one of the first and most difficult tasks you'll face on your privacy journey." privacyguides.org/en/basics/th…
That does raise the question about whether we want to make information available for someone on a "privacy journey" or "security journey" or some other type of journey. blog.hubspot.com/marketing/tar…
I suspect that
securityguides.orgisn't being used like how privacyguides.org is right now.Target audience: How to find yours [+ real-life examples]
Kayla Schilthuis-Ihrig (HubSpot)splendid9583 likes this.
med
in reply to Zenlix • • •I'd agree that a hardware solution would be best. Something designed specifically to do it. I've been eyeing up the biometric yubikey for a while.
I do this for ssh keys, VPN certs and pgp keys. My solution is pretty budget, I generate the keys on a LUKS encrypted USB and run a script that loads them in to agents, and flushes them on sleep. The script unlocks and mounts the LUKS partition, adds the keys to agents, unmounts and locks the USB. The passwords I just remember for the unlock and load into memory, but they're ripe for stuffing in to keepass-xc - I need to look at the secret service api and incorporate that in to the script to fetch the unlock passwords directly from keepass.
I have symlinks in the default user directories to the USB's mount points, like
~/.ssh/id_ed25519 -> /run/media/<user>/<mount>/id_ed25519. By default, when you run ssh-agent, it tries to add keys in the default places.The way it works for me is:
- plug the USB in to the laptop after a restart or wake-up
- run script
- enter passwords
... Show more...I'd agree that a hardware solution would be best. Something designed specifically to do it. I've been eyeing up the biometric yubikey for a while.
I do this for ssh keys, VPN certs and pgp keys. My solution is pretty budget, I generate the keys on a LUKS encrypted USB and run a script that loads them in to agents, and flushes them on sleep. The script unlocks and mounts the LUKS partition, adds the keys to agents, unmounts and locks the USB. The passwords I just remember for the unlock and load into memory, but they're ripe for stuffing in to keepass-xc - I need to look at the secret service api and incorporate that in to the script to fetch the unlock passwords directly from keepass.
I have symlinks in the default user directories to the USB's mount points, like
~/.ssh/id_ed25519 -> /run/media/<user>/<mount>/id_ed25519. By default, when you run ssh-agent, it tries to add keys in the default places.The way it works for me is:
I keep break-glass spares in a locked cabinet in my house and office, both with different recovery keys
I do this because it's my historical solution, and I haven't evaluated the hardware options seriously yet.
floquant
in reply to Zenlix • • •But for improved security, you could use a Yubikey or similar hardware token.
like this
splendid9583 likes this.
AstroLightz
in reply to Zenlix • • •