linux-kernel - Re: new GPG key

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20141018154211.GA4426@fritha.org>
Date:	Sat, 18 Oct 2014 17:42:11 +0200
From:	Heinz Diehl <htd+ml@...tha.org>
To:	linux-kernel@...r.kernel.org
Cc:	Linus Torvalds <torvalds@...ux-foundation.org>,
	Gleb Natapov <gleb@...nel.org>,
	Christoffer Dall <christoffer.dall@...aro.org>,
	Christian Borntraeger <borntraeger@...ibm.com>,
	Cornelia Huck <cornelia.huck@...ibm.com>,
	Marc Zyngier <marc.zyngier@....com>,
	Alexander Graf <agraf@...e.de>,
	Avi Kivity <avi.kivity@...il.com>,
	stefano.stabellini@...citrix.com, Laszlo Ersek <lersek@...hat.com>,
	KVM list <kvm@...r.kernel.org>, konstantin@...uxfoundation.org
Subject: Re: new GPG key

On 18.10.2014, Paolo Bonzini wrote: 

> 5) Get a smartcard or a Yubikey NEO and put the subkeys on it; replace
> subkeys with stubs on your usual working machines, especially laptops. It
> gives you two factor authentication for free, and can also be used for
> SSH if you add a third subkey.

AFAICS, a lot of the lkml people use the mutt MUA, which does not have
any password encryption natively. In this case, the smartcard
has another advantage: you can have your email password encrypted 
and use it without having to enter a long and complicated passphrase.
In case your laptop gets stolen while travelling, the password to your
email is protected.

Here's what I did:

1. Generate a password file and assign the password to a variable.

touch .my-pw
echo "set my_pw_imap = \"your-long-and-random-password\"" > .my-pw

2. Encrypt this file to your own public key and shred the unencrypted textfile
3. Source the password file into .muttrc and set the imap password
   variable by writing something like this into your .muttrc:

 source "gpg2 -dq $HOME/.my-pw.asc |"
 set imap_pass=$my_pw_imap

Now, if you start mutt and it connects to your IMAP server, you'll be
prompted for your smartcards PIN, and that's it. In case your
laptop gets stolen while you're travelling and you don't have access
to the net (because all the other things in your bag like your mobile 
also got stolen), it will spare you the situation where the thief 
already had logged into your email and changed your password when 
you finally managed to connect to the net again.

Sorry for being OT, but I have encountered such a situation before and
it got me into serious trouble, so I dared to share this with you.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/