up vote 5 down vote favorite
1
share [g+] share [fb]

I would like to use dropbox for backing up my gpg keys, IMHO even if dropbox admins gets a copy of the keys they still need the passphrase to use it so is it ok to assume this is safe to do so?

link|improve this question
I don't actually know what kind of encryption GPG uses to protect its private keys, so I can't comment on the security of it, but I would not do this. I'd just create a different key for each computer I need one on, so that each key never leaves the computer it's created on. – David Zaslavsky Sep 14 '10 at 3:45
1  
I also keep encrypted files in drop box that i need to access from multiple machines so i need to sync the same gpg key. – Hamza Yerlikaya Sep 14 '10 at 4:33
in which case can you encrypt the keys with something you can unencrypt anywhere (an OTFE volume maybe) and stick that on DropBox? Or carry the key files around with you on a USB stick? – DMA57361♦ Sep 14 '10 at 7:55
feedback

1 Answer

up vote 3 down vote

I would advise against doing this. True, they need the passphrase, but you should still always keep your private keys under your own direct control. GPG depends on the security model of requiring something you know (the passphrase) and something you have (the key). By letting your key get out there, you're running the risk of completely defeating half of the authentication scheme. I doubt that DropBox employees would ever cross you intentionally, but if they were to have a security breach allowing a 3rd party attacker to gain access, you would be in a bad situation. It would be much safer to keep your keys backed up on some type of physical media like a flash drive.

link|improve this answer
+1 You password is the weakest link in the chain (it's much smaller and so much easier to brute force (or guess!) than any other part) - if you give someone everything but the password, well, you see my point... – DMA57361♦ Sep 14 '10 at 7:53
If you want to keep it there so that you don't loose it, encrypt the key using for instance 7-Zip and a strong password, different from the pass-phrase. Make sure you don't forget it. – user39559 Sep 14 '10 at 9:39
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.