I mainly use Kleopatra with a dedicated passphrase for it.
this post was submitted on 11 Nov 2025
30 points (100.0% liked)
Linux
59531 readers
1412 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 6 years ago
MODERATORS
If the private keys have a passphrase they're already encrypted. The fact that it's a text file doesn't mean it's a plaintext file. But for improved security, you could use a Yubikey or similar hardware token.
I don’t, since I read https://www.latacora.com/blog/2019/07/16/the-pgp-problem/
This is very interesting information!
I'd like to note that it's likely that several recommendations used as examples have been superseded with information around https://www.privacyguides.org/en/real-time-communication/ and similar locations, since expressing "use WhatsApp" makes me suspicious (and "use Wire" does not make me more confident): https://www.makeuseof.com/why-i-dont-trust-whatsapp/ https://proton.me/blog/is-whatsapp-safe
The link I posted focuses on security, what you post focuses on privacy. Wire is a very secure protocol but WhatsApp being owned by Meta still makes it a privacy nightmare.
Signal is probably a better choice in that case.
It seems that the people managing privacyguides.org believe that "Balancing security, privacy, and usability is one of the first and most difficult tasks you'll face on your privacy journey." https://www.privacyguides.org/en/basics/threat-modeling/
That does raise the question about whether we want to make information available for someone on a "privacy journey" or "security journey" or some other type of journey. https://blog.hubspot.com/marketing/target-audience
I suspect that securityguides.org isn't being used like how privacyguides.org is right now.
I'd agree that a hardware solution would be best. Something designed specifically to do it. I've been eyeing up the biometric yubikey for a while.
I do this for ssh keys, VPN certs and pgp keys. My solution is pretty budget, I generate the keys on a LUKS encrypted USB and run a script that loads them in to agents, and flushes them on sleep. The script unlocks and mounts the LUKS partition, adds the keys to agents, unmounts and locks the USB. The passwords I just remember for the unlock and load into memory, but they're ripe for stuffing in to keepass-xc - I need to look at the secret service api and incorporate that in to the script to fetch the unlock passwords directly from keepass.
I have symlinks in the default user directories to the USB's mount points, like ~/.ssh/id_ed25519 -> /run/media/<user>/<mount>/id_ed25519. By default, when you run ssh-agent, it tries to add keys in the default places.
The way it works for me is:
- plug the USB in to the laptop after a restart or wake-up
- run script
- enter passwords for luks key, ssh-agent, gpg agent etc.
- Unplug USB.
I keep break-glass spares in a locked cabinet in my house and office, both with different recovery keys
I do this because it's my historical solution, and I haven't evaluated the hardware options seriously yet.
I store them in an app on my phone behind password protection
You should not store your privates keys unencrypted. In fact by default your keys are stored password protected just as if you'd store them in keepass.
How secure is the password protection?
Depends on how strong your password is and the environment you are entering the password in
It differs between software vendors and versions. For example, if you're using a recent version of gnupg, your key is most likely stored using openpgp-s2k3-ocb-aes. Use that as a starting point to find more information on how good the protection is. I personally would rate it a fair bit lower compared to the key derivation methods used in keepass which focus more on brute force resistance.
Is also storing your gpg keys in KPXC unsuitable for your purposes?
I am not OP, but that would be the ideal solution for me. Unfortunately, KPXC does not support communication with the GPG agent and the team is not interested in adding this feature due to it being «[…] far more complicated than ssh-key management. There are already excellent tools for this, Kleopatra being the best».
That would chsnge nothing, simce they would also be on the hard drive.
Have them in a plain-text but encrypted with gpg?