My target is to use pass to store a lot of passwords and be able to access those passwords from wherever I need them, possibly using just a single pass-thing (password, passphrase, my voice, my fingerprint, my eyes, ...), so the short question could be

What is the correct way to use pass?

I've read several guides about that, but none of them (actually none of the ones I understood) deeply analyzes the relation of this tool with gpg (which is required), since it has several implications connected with the fact that files/drives can be stolen as well as broken, and one should procted those objects from the former, the latter, or both risks.

In the original question I described what I've understood so far.

I ask you to help me understand if the conclusions I drawn in the final bullet list are correct?

Original post

I had never used GnuPG intentionally when yesterday I created a keypair, choosing a hopefully bulletproof passphrase.

I did this in order to have an id to use with pass, with which I want to store the ever-growing unmanageably long list of passwords relative to this and that site. So I've installed pass and set it up too, then I inserted all the passwords in the store, and my cat as well.

After this, all I have is basically two directory trees, namely ~/.gnupg set up by gpg commands I used to create the keys, and ~/password-store which I set up and populated by means of pass commands.

Now, my computer could either be cracked (by someone who's desperately in need for my secret cooking recipes), or explode, so I'd like you to help me understand what to do next.

With respect to protection from ill-intentioned people and from physical failure, are the following true?

  1. I have to keep the ~/password-store directory in the devices I use, as long as I need to access passwords from there on a daily basis.
  2. I have to keep the ~/password-store on an external device as well (either one, indestructible or more, redundant).
  3. I don't have to be afraid of 1., as long as the passphrase is not violated.
  4. There's also no need for me to export and upload my public key elsewhere, as long as I don't need to sign messages, but I could (point 6.).
  5. The private key (just like the public one) can not be stolen from my system, but it cannot be used as long as the passphrase is not violated, and I have not exported it (the private key) on a file on that system drive/disk/etc reachable by others.
  6. In order not to lose the public key I have to export it and (either 6.1 or 6.2 is enough)

    6.1. copy it on an external device (bla bla), or

    6.2. upload it on a keyserver.

  7. I have to export and copy the private key on an external drive.
  8. The passphrase can also be only in my mind, as long as my memory helps me.

More synthetically I think I have to

  • remember the passphrase (1 string);
  • store the exported private key (1 file) on a drive safe from thieves;
  • alternatively store the exported public key (1 file) on a drive safe from physical damage, or on a keyserver;
  • store ~/.password-store (1 directory) on a drive safe from physical failure, and have it available from wherever I need access to a password (uploading it on GitHub would be ideal, right?).
  • this is not on-topic on StackOverflow – schroeder Sep 24 '18 at 9:13
  • @schroeder, what about unix.stackexchange? – Enlico Sep 24 '18 at 11:44
  • 1
    This really seems on-topic here. – schroeder Sep 24 '18 at 12:46
  • Ok, then I'll wait for a good soul. – Enlico Sep 24 '18 at 12:47
  • 1
    Please try to phrase it in a more concrete question. You provide a long list of assumptions and ideas, but it seems rather unclear what answer you expect, which could be accepted as solving your problem. And I think your actual question is interesting and on-topic here. – allo Sep 24 '18 at 13:46

While I'm not sure there can be a concrete "correct" way of using pass, what you've described is a reasonably safe setup and I think your assumptions (except maybe #5) are accurate.

To use pass to manage your passwords you need to access(from each PC you might use)

  1. A copy of your /password-store/ directory
  2. Your gpg private key

To protect the availability of your passwords you need to back up

  1. Your gpg private key (public is included in the gpg --export-secret-key process iirc)
  2. your /password-store/ directory

While your password files are encrypted and it's (theoretically) safe to leave them in the open I personally wouldn't leave them in an open GitHub repo. If you don't have a paid subscription with them there are other providers that offer private repositories for free (or you could spin one up on your own hardware/VPS).

Another thought I'd add is to consider using a smart card to transport your secret key. It's a convenient way to get the key between different machines you may want to use it from that

  1. Can't be copied as easily as it could be from a regular flash drive.
  2. Doesn't leave the key on the box when you're not using it (it lives on the card).
  • About #5, maybe I poorly expressed my thoughts; can you check if the current edit still is not accurate in you opinion? If so, it might mean that there's some lacuna in my understanding of the matter. You remember correctly, an embedded public key is in the exported secret key. Yes, I know some provider offering private repos for free, fortunately. Concerning the smartcard, I'll give try to understand how to use it (before buying it, LOL). – Enlico Oct 11 '18 at 6:17
  • Yes, I think that edit makes it more accurate. Definitely you should look into how to use the smartcard before investing in it, there are a number of resources that can explain how to set them up but I found this one particularly useful when I was trying to figure it out. – user8675309 Oct 11 '18 at 13:54
  • As a side-question after so much time, your last point 2 about the key living on the card: cleary that's not a smart-card peculiartity, and holds for any flash drive as well, doesn't it? – Enlico Jan 14 '19 at 13:48
  • No, I should've explained better in my answer. When I say "can't be copied as easily" what I mean is smart cards are designed with the idea that it should be impossible to extract (copy) the secret key from them, ever. GPG can utilize the secret key only while the smart card is physically attached to the machine (plugged in). I used the phrase "can't be copied as easily" because it seems no security measure is actually impossible to defeat. Flash drives would permit reading the secret key as easily as any hard drive would. – user8675309 Jan 14 '19 at 15:06
  • Yes, that's point 1 (easy to copy from flash drive, hard to copy from smart card), and you were clear enough. Point 2 is about the key living on the external object, and I'm asking confirmation that the object can be a flash drive or smartcard, or whatever. – Enlico Jan 14 '19 at 15:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.