I've come to the conclusion that I need to up my security. I currently have a dozen memorized passwords I use for every device and website. I'm against KeePass/Lastpass due to having to trust they haven't been compromised. Same goes for using an RSA Key.
My Idea of a Solution:
I'd have a dedicated unix box (perhaps bsd, perhaps debian) hosted in my cloud. It would have gpg, pass, pwgen, and a ssh server.
This box would only be accessible with the keyfile, and I'd generate a unique key for each client of mine. In case of a compromised device, I can revoke that key.
I would generate passwords using pass, which generates, manages, and using a gpg key encrypts passwords.
I would backup my password-store using
rsync, or some sort of
cron jobto push the password-store through
sftp, but a digital copy of my gpg key would never leave the server.
I'd keep a copy of my gpg key as a qr code in a safety deposit box.
Does this seem like a working model or are there already holes? Am I in over my head trying to roll my own password management system?