Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Agreed. Turns out the best backup medium is paper: print out the secret bits and store them in a safe. The paperkey tool can do this and QR codes can make it really convenient. I even added binary decoding interfaces to zbar to support this exact use case.

https://www.jabberwocky.com/software/paperkey/

https://wiki.archlinux.org/title/Paperkey

  gpg --export-secret-key $KEY | paperkey --output-type raw | qrencode --8bit --output $KEY.png
  zbarcam --raw --oneshot -Sbinary | paperkey --pubring $KEY.gpg | gpg --import
Not every key needs to be backed up. Signing keys are ephemeral, losing one is inconsequential. Losing an encryption key means it'll be impossible to decrypt data later so backups could be interesting. The master key should be kept permanently offline in a physical safe.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: