My target is to use
pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my fingerprint, my eyes, ...), so the short question could be
What is the correct way to use
I've read several guides about that, but none of them (actually none of the ones I understood) deeply analyzes the relation of this tool with
gpg (which is required), since it has several implications connected with the fact that files/drives can be stolen as well as broken, and one should procted those objects from the former, the latter, or both risks.
In the original question I described what I've understood so far.
I ask you to help me understand if the conclusions I drawn in the final bullet list are correct?
I had never used GnuPG intentionally when yesterday I created a keypair, choosing a hopefully bulletproof passphrase.
I did this in order to have an id to use with
pass, with which I want to store the ever-growing unmanageably long list of passwords relative to this and that site. So I've installed
pass and set it up too, then I inserted all the passwords in the store, and my cat as well.
After this, all I have is basically two directory trees, namely
~/.gnupg set up by
gpg commands I used to create the keys, and
~/password-store which I set up and populated by means of
Now, my computer could either be cracked (by someone who's desperately in need for my secret cooking recipes), or explode, so I'd like you to help me understand what to do next.
With respect to protection from ill-intentioned people and from physical failure, are the following true?
- I have to keep the
~/password-storedirectory in the devices I use, as long as I need to access passwords from there on a daily basis.
- I have to keep the
~/password-storeon an external device as well (either one, indestructible or more, redundant).
- I don't have to be afraid of 1., as long as the passphrase is not violated.
- There's also no need for me to export and upload my public key elsewhere, as long as I don't need to sign messages, but I could (point 6.).
- The private key
(just like the public one)can notbe stolen from my system, but it cannot be used as long as the passphrase is not violated, and I have not exported it (the private key) on a file on that systemdrive/disk/etc reachable by others.
In order not to lose the public key I have to export it and (either 6.1 or 6.2 is enough)
6.1. copy it on an external device (bla bla), or
6.2. upload it on a keyserver.
- I have to export and copy the private key on an external drive.
- The passphrase can also be only in my mind, as long as my memory helps me.
More synthetically I think I have to
- remember the passphrase (1 string);
- store the exported private key (1 file) on a drive safe from thieves;
- alternatively store the exported public key (1 file) on a drive safe from physical damage, or on a keyserver;
~/.password-store(1 directory) on a drive safe from physical failure, and have it available from wherever I need access to a password (uploading it on GitHub would be ideal, right?).