5

I'm using Seahorse on Ubuntu, and I found that using the 'export secret key' option allows me to save an unencrypted *.asc file containing my GnuPG private key, with neither root access nor the password used to secure the key. I cannot change the picture or other settings for the key without entering that password.

I am very new at this, but it seems to be a security risk. How can I configure my key so it can't be exported at the click of a button?

polymerasechainreaction
  • 51

2 Answers2

2

It's not a security risk. The only vulnerability you are ;). You have to make sure that does not get your private key into the wrong hands.

Everyone who has access to your system and has sufficient access rights, can copy your key. Seahorse can not prevent that, too.

Encrypt your partitions and use a sufficiently strong password for your user account. Lock your system when you leave your workstation. Made sure that your backups are encrypted.

A.B.
  • 90,397
1

Using GnuPG, your keys are stored within your own home directory -- thus, no root permissions are required.

If your key is password protected, this password is required for exporting the key. The password could be stored/cached in two ways, though:

  • Seahorse itself storing it in its password store or
  • gpg-agent being active, caching the password for a while.
Jens Erat
  • 5,051
  • 7
  • 31
  • 37