Ask HN: How do you backup your private keys?

#1

Post by level09 » Fri, Dec 25, 2015, 10:31 AM UTC

Obviously storing keys on the cloud is the least secure option. I would like to know if it is best to print them out on paper? or generate QR codes? looking forward to hearing some strategies and best practices.

Re: Ask HN: How do you backup your private keys?

#2

Post by tux » Fri, Dec 25, 2015, 10:42 AM UTC

Print it and put it a safe place. Then when you need it again, simply use a scanner ;-)

Re: Ask HN: How do you backup your private keys?

#3

Post by deno » Fri, Dec 25, 2015, 10:47 AM UTC

https://www.nitrokey.com/

or print out on paper[1][2][3]/burn a DVD/write on floppy/etc but the encrypted version with very good passphrase. Don’t ever store private keys in plain text.

[1] http://www.jabberwocky.com/software/paperkey/

[2] http://ronja.twibright.com/optar/

[3] http://blog.liw.fi/posts/qr-backup/

Re: Ask HN: How do you backup your private keys?

#4

Post by atmosx » Fri, Dec 25, 2015, 12:14 PM UTC

deno wrote: post #3

https://www.nitrokey.com/ or print out on paper[1][2][3]/burn a DVD/write on floppy/etc but the encrypted version with very good passphrase. Don’t ever store private keys in plain text. [1] http://www.jabberwocky.com/software/paperkey/ [2] http://ronja.twibright.com/optar/ [3] http://blog.liw.fi/posts/qr-backup/

I use this backup method too :-)

Re: Ask HN: How do you backup your private keys?

#5

Post by Raed667 » Fri, Dec 25, 2015, 1:23 PM UTC

I use a micro SD card (TrueCrypt) that I keep in my safe. I've had to use it twice now, both because of sudden disk failure.

Re: Ask HN: How do you backup your private keys?

#6

Post by jb510 » Fri, Dec 25, 2015, 2:50 PM UTC

I put them in my password manager (1Password) as a secure note, and then put its encrypted data file in DropBox. I wish I trusted DropBox a bit more these days (Condolezza), but I trust 1P's data file encryption and having that whole password archive cloud accessible has saved my butt more than once, once for SSH keys.

Re: Ask HN: How do you backup your private keys?

#7

Post by mgreenly » Fri, Dec 25, 2015, 4:57 PM UTC

jb510 wrote: post #6

I put them in my password manager (1Password) as a secure note, and then put its encrypted data file in DropBox. I wish I trusted DropBox a bit more these days (Condolezza), but I trust 1P's data file encryption and having that whole password archive cloud accessible has saved my butt more than once, once for SSH keys.

I also make mine available online but do it a bit different.

I have a public dotfiles project on Github. In addition to my dotfiles it includes a symmetrically encrypted tarfile of a secrets folder that contains keys and other sensitive info.

To recover my keys I only need access to github, gpg and the password for the encrypted tarfile.

Re: Ask HN: How do you backup your private keys?

#8

Post by edoceo » Fri, Dec 25, 2015, 8:28 PM UTC

I use QR for long term storage. Encrypted tarball in my GitHub as well

Re: Ask HN: How do you backup your private keys?

#9

Post by delcaran » Sat, Dec 26, 2015, 10:25 AM UTC

An encfs folder in my dropbox. The password for that encfs is in the same dropbox, inside a Keepass2 database.

Re: Ask HN: How do you backup your private keys?

#10

Post by 0942v8653 » Sat, Dec 26, 2015, 1:05 PM UTC

A password manager on your smartphone isn't a bad place if you always have it with you. I think backing up to an encrypted HDD and my phone is redundant enough for me.

If you have a password store in the cloud, I recommend KeePass's keyfile feature. With a keyfile (again backed up, but never in the cloud), you can make sure that it takes more than just the master password to get in. If e.g. Dropbox ever gets compromised, and for some reason they can guess your password, keyfile will keep you safe.