My target is to use pass
to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my fingerprint, my eyes, ...), so the short question could be
What is the correct way to use pass
?
I've read several guides about that, but none of them (actually none of the ones I understood) deeply analyzes the relation of this tool with gpg
(which is required), since it has several implications connected with the fact that files/drives can be stolen as well as broken, and one should procted those objects from the former, the latter, or both risks.
In the original question I described what I've understood so far.
I ask you to help me understand if the conclusions I drawn in the final bullet list are correct?
Original post
I had never used GnuPG intentionally when yesterday I created a keypair, choosing a hopefully bulletproof passphrase.
I did this in order to have an id to use with pass
, with which I want to store the ever-growing unmanageably long list of passwords relative to this and that site. So I've installed pass
and set it up too, then I inserted all the passwords in the store, and my cat as well.
After this, all I have is basically two directory trees, namely ~/.gnupg
set up by gpg
commands I used to create the keys, and ~/password-store
which I set up and populated by means of pass
commands.
Now, my computer could either be cracked (by someone who's desperately in need for my secret cooking recipes), or explode, so I'd like you to help me understand what to do next.
With respect to protection from ill-intentioned people and from physical failure, are the following true?
- I have to keep the
~/password-store
directory in the devices I use, as long as I need to access passwords from there on a daily basis. - I have to keep the
~/password-store
on an external device as well (either one, indestructible or more, redundant). - I don't have to be afraid of 1., as long as the passphrase is not violated.
- There's also no need for me to export and upload my public key elsewhere, as long as I don't need to sign messages, but I could (point 6.).
- The private key
(just like the public one)cannotbe stolen from my system, but it cannot be used as long as the passphrase is not violated, and I have not exported it (the private key) on afile on that systemdrive/disk/etc reachable by others. In order not to lose the public key I have to export it and (either 6.1 or 6.2 is enough)
6.1. copy it on an external device (bla bla), or
6.2. upload it on a keyserver.
- I have to export and copy the private key on an external drive.
- The passphrase can also be only in my mind, as long as my memory helps me.
More synthetically I think I have to
- remember the passphrase (1 string);
- store the exported private key (1 file) on a drive safe from thieves;
- alternatively store the exported public key (1 file) on a drive safe from physical damage, or on a keyserver;
- store
~/.password-store
(1 directory) on a drive safe from physical failure, and have it available from wherever I need access to a password (uploading it on GitHub would be ideal, right?).