gnupg keys and pass database - Protecting both from unauthorised access and loss

Question

My target is to use pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my fingerprint, my eyes, ...), so the short question could be

What is the correct way to use pass?

I've read several guides about that, but none of them (actually none of the ones I understood) deeply analyzes the relation of this tool with gpg (which is required), since it has several implications connected with the fact that files/drives can be stolen as well as broken, and one should procted those objects from the former, the latter, or both risks.

In the original question I described what I've understood so far.

I ask you to help me understand if the conclusions I drawn in the final bullet list are correct?

Original post

I had never used GnuPG intentionally when yesterday I created a keypair, choosing a hopefully bulletproof passphrase.

I did this in order to have an id to use with pass, with which I want to store the ever-growing unmanageably long list of passwords relative to this and that site. So I've installed pass and set it up too, then I inserted all the passwords in the store, and my cat as well.

After this, all I have is basically two directory trees, namely ~/.gnupg set up by gpg commands I used to create the keys, and ~/password-store which I set up and populated by means of pass commands.

Now, my computer could either be cracked (by someone who's desperately in need for my secret cooking recipes), or explode, so I'd like you to help me understand what to do next.

With respect to protection from ill-intentioned people and from physical failure, are the following true?

1. I have to keep the ~/password-store directory in the devices I use, as long as I need to access passwords from there on a daily basis.
2. I have to keep the ~/password-store on an external device as well (either one, indestructible or more, redundant).
3. I don't have to be afraid of 1., as long as the passphrase is not violated.
4. There's also no need for me to export and upload my public key elsewhere, as long as I don't need to sign messages, but I could (point 6.).
5. The private key (just like the public one) can not be stolen from my system, but it cannot be used as long as the passphrase is not violated, and I have not exported it (the private key) on a file on that system drive/disk/etc reachable by others.

6. In order not to lose the public key I have to export it and (either 6.1 or 6.2 is enough)

   6.1. copy it on an external device (bla bla), or

   6.2. upload it on a keyserver.

7. I have to export and copy the private key on an external drive.
8. The passphrase can also be only in my mind, as long as my memory helps me.

More synthetically I think I have to

• remember the passphrase (1 string);
• store the exported private key (1 file) on a drive safe from thieves;
• alternatively store the exported public key (1 file) on a drive safe from physical damage, or on a keyserver;
• store ~/.password-store (1 directory) on a drive safe from physical failure, and have it available from wherever I need access to a password (uploading it on GitHub would be ideal, right?).

Answer 1

While I'm not sure there can be a concrete "correct" way of using pass, what you've described is a reasonably safe setup and I think your assumptions (except maybe #5) are accurate.

---

To use pass to manage your passwords you need to access(from each PC you might use)

1. A copy of your /password-store/ directory
2. Your gpg private key

To protect the availability of your passwords you need to back up

1. Your gpg private key (public is included in the gpg --export-secret-key process iirc)
2. your /password-store/ directory

---

While your password files are encrypted and it's (theoretically) safe to leave them in the open I personally wouldn't leave them in an open GitHub repo. If you don't have a paid subscription with them there are other providers that offer private repositories for free (or you could spin one up on your own hardware/VPS).

Another thought I'd add is to consider using a smart card to transport your secret key. It's a convenient way to get the key between different machines you may want to use it from that

1. Can't be copied as easily as it could be from a regular flash drive.
2. Doesn't leave the key on the box when you're not using it (it lives on the card).