Creating the perfect GPG keypair
alexcabal.com
Creating the perfect GPG keypair
1–10 of 40 posts
Re: Creating the perfect GPG keypair
#2I really like this walkthrough. GPG/PGP is pretty complex and getting all the pieces correct is very difficult. In fact, one major reason that I don't use encryption more is that I'm scared that I'll forget a passphrase, or not transfer my keys to a new computer, or lose my "master" key.
However, I wonder if something like Keybase.io might be better. Using Keybase I can do everything outlined in this walkthrough but in a much more user friendly way. I can even instruct other users on how to send me encrypted files without too much trouble. Does Keybase replace the need for shuffling keys around and worrying about losing my keys?
Re: Creating the perfect GPG keypair
#3And the length of this is exactly the reason why Johnny still can't encrypt and doesn't want to know how.
Getting things right, including disaster recovery, should be done correctly and silently by default.
Re: Creating the perfect GPG keypair
#4I really like this walkthrough. GPG/PGP is pretty complex and getting all the pieces correct is very difficult. In fact, one major reason that I don't use encryption more is that I'm scared that I'll forget a passphrase, or not transfer my keys to a new computer, or lose my "master" key. However, I wonder if something like Keybase.io might be better. Using Keybase I can do everything outlined in this walkthrough but…
Keybase does offer to store your passphrase-protected private key with them (but never requires it!), so it does help to alleviate those problems. On the other hand, you could do the same using any kind of file syncing tool. And you still have to remember the paraphrase.
More importantly than that, though, since Keybase offers a new way of authenticating any key you upload (even if it's less secure than meeting personally and signing each other's keys), losing it is much less problematic, as you can just generate, upload and authenticate a new one.
Re: Creating the perfect GPG keypair
#5I can see a subtle problem with that scheme - the attacker will be able to read also all of your future communication.
Re: Creating the perfect GPG keypair
#6The arguments made by Alan Eliasen seem worth considering to me. And his tutorial is great.
Re: Creating the perfect GPG keypair
#7And the length of this is exactly the reason why Johnny still can't encrypt and doesn't want to know how. Getting things right, including disaster recovery, should be done correctly and silently by default.
Not everyone has the same threat model, not everyone needs all of that. Johnny can encrypt.
Re: Creating the perfect GPG keypair
#8I think it's time we finally move to generating and storing secret keys on secure elements (Yubikey, NitroKey). This way we only need to worry about the physical security of the key and nothing else.
No air-gapped machine and a random flash memory stick (for storing the backup of the private key) can be considered as secure as the secure element.
Re: Creating the perfect GPG keypair
#9I think it's time we finally move to generating and storing secret keys on secure elements (Yubikey, NitroKey). This way we only need to worry about the physical security of the key and nothing else. No air-gapped machine and a random flash memory stick (for storing the backup of the private key) can be considered as secure as the secure element.
And then you drop your key and lose it. Or it gets ran over by a car or something. Now what?
I love my Yubikey, but I generated the keys on it on an air-gapped machine and wrote them to two DVDs and the Yubikey.
Unless you can get everyone to send you messages to encrypt them to both your main key and your secondary backup key you will regret not having backed up your primary key.
Re: Creating the perfect GPG keypair
#10I can see a subtle problem with that scheme - the attacker will be able to read also all of your future communication.
I don't understand. What attacker? (One who compromises the laptop?) Communication encrypted with which key?