Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I want to decrypt mails on a public PC (café), encrypted with GPG, in e.g. gmail with the extension "Mailvelope" or equal - how would that be possible?

I found tools to run from an USB stick where you need to store the gpg keyring and the tool. For "Mailvelope" I need to import the keys (also the private key) to decrypt. How safe is it, to import a private key there? Isn't the key itself secured by my passphrase? What could people do with my priv. key only?

share|improve this question
add comment

2 Answers

As soon as you decrypt the data on the public PC, you must consider that it has been broken. It could be relatively safe to use such a PC to download that data onto a USB stick (assuming that you're not infecting that stick with some kind of malware at that time - another issue) but it's absolutely NOT safe to decrypt your data on said PC.

Protecting your private key with a passphrase does not grant you any guarantee: on a public machine, you're one keylogger away from losing it to the bad boys.

As to what could someone do with your private key without the password, well, they can try an offline attack in order to try to recover it. If your passphrase is long and complex enough, that might make this attack impractical but remember that, at the very least, CPU power is always increasing and that an attacker who has your encrypted private key is free to use as many systems in parallel as he wants to crack it.

So, unless all you want to protect is your private diary from your kid brother, I would not decrypt anything sensitive on a public machine (or place) if I were you.

share|improve this answer
add comment

Any public PC could be riddled with traffic analysis malware, keyloggers and other nefarious pieces of software. In particular, if you plug a USB key in the PC and run some code from that key, then you have just demonstrated that the PC is configured to actually allow running arbitrary software from USB keys -- probability that the PC is "clean" is, at that point, abysmally low.

This is true for your PGP keys, but also for any authentication password that you type on the machine. In order to obtain the PGP-encrypted email in the first place, then you must probably connect to your Webmail, which will require a password. If you typed the password, then you're toast.

Personally I never use a public PC to do anything which is not inherently public. I will use such a machine to lookup maps and information Web sites, but not to access my private data, and that includes my emails.


What could work, though, would be a personal computer (say, a smartphone) which plugs through USB on the public PC, and presents some software which, when executed, runs a network proxy for the smartphone, taking care of encoding and decoding packets into some custom USB-based protocol. In essence, this would turn the public PC into a glorified network access point, which needs not be trusted as long as only "secure" protocols are used from the personal computer (SSL, SSH...). I am not aware of a readily available implementation, but it would theoretically work, at least as long as the public PC allows running custom software from an inserted USB key.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.