What security risks can be caused by leaking .gnupg directory (for example, accidentally committing it to GitHub) when private keys are stored on a smart card?


There's a good reason this folder normally has permissions set to 700 and it certainly should not be published.

  • gpg.conf contains your GnuPG configuration. If there's some weak settings, it might be usable information for targeted attacks. Most has some default configuration from the distribution, which makes this the least interesting file.

  • pubring.gpg contains all your contacts (and your own public keys). It's like leaking your address book, but worse: it possibly has information specifically on all the contacts you would rather communicate in private with.

  • trustdb.gpg contains your entire trust database. That may reveal weak points if you trust some keys too much, and helps further in mapping your (most private) social network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.