2

I have a GNUPG file that i use to store all my passwords locally(Dont know if it is a good idea). The question is, is it safe to push the GNUPG file to github so i can access it from anywhere?

  • 3
    Is is safe from what? What are you concerned about? – schroeder Aug 29 '18 at 10:23
2

It's encrypted, so in theory it's safe, provided your encryption key/password is of sufficient quality.

But if you're making your database public, that's pretty much an invitation for people to try cracking it. If your key is not as strong as you think, or if you slip up in some other way (falling for a phishing attack for example), then you are at risk. I think posting your database publicly is a bad idea. Just because something shouldn't be at risk if it's in the hands of attackers, doesn't mean you should volunteer to be a target. Just like a website keeps its password hashes private as a first line of defense, your first line of defense should be keeping your password file out of the hands of attackers. They can't even try to attack what they don't have yet.

I suggest using an online storage service that offers private access (such as: Dropbox, Google Drive, OneDrive, etc.) to store your encrypted passwords for convenient multi-device access but still keep them hidden from most attackers.

Off-topic: have you considered a password manager designed for the purpose? If you want a local-only tool, KeePass, PasswordSafe, and other options exist. I think you'll find the convenience increases quite a bit with the same level of security (or better, as you you don't need to worry about temporary files created on decryption).

  • Thank you for your suggestions. I was willing to do this project as a simple password manager with git or git like integration. I sometimes also need access to these passwords on servers hence i was looking for a CLI interface. How about using a private git repo like bit bucket which is free for small user groups ? – omkar joglekar Aug 29 '18 at 16:46
  • I'm sure private repo should be fine; it's still important to make sure to use a strong key but at least it's not publicly available for attack unless your Bitbucket account gets compromised. – Ben Aug 29 '18 at 19:51
  • 1
    Not posting your private key in public is not security through obscurity... – forest Sep 4 '18 at 8:08
  • You're right, "not posting your private key in public" is not security through obscurity. Arguably not posting your encrypted database publicly could be considered security through obscurity, since in theory the encryption should protect the database all by itself. I rephrased to make it clearer what I was talking about. It's more "defense in depth" than "security through obscurity", but at the same time in theory it should be safe to publish an encrypted database, it's just not a great idea, which is what I was trying to communicate. – Ben Sep 4 '18 at 21:14
  • @forest, thinking about this some more, you're correct. I've removed the "security through obscurity" line and rephrased to reflect the point I was actually trying to make. – Ben Sep 6 '18 at 15:02
-1

The pass password manager works in essentially the way you are proposing by putting each password (plus optional additional information) in an individual PGP encrypted file and checking it into git in order to move it around. While it isn't the most popular password manager it is popular enough that if this caused serious problems it would probably be known.

I use pass myself although I use an ssh account (authenticated via gpg-agent and my PGPCard) on a rented personal VM rather than github although all this does is hide the filenames, named after the sites for which they are used, which pass uses and wouldn't really make a difference for your all in one file scenario.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.