<html xmlns="http://www.w3.org/1999/xhtml" xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office"><head><!--[if gte mso 9]><xml><o:OfficeDocumentSettings><o:AllowPNG/><o:PixelsPerInch>96</o:PixelsPerInch></o:OfficeDocumentSettings></xml><![endif]--></head><body><div class="ydpdcee47c5yahoo-style-wrap" style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:16px;"><div></div>
<div dir="ltr" data-setdir="false"><div><div dir="ltr" data-setdir="false">Werner Koch said:</div><div><br></div><div>> > After you insert and use your Gnuk token smartcard the gpg-agent will</div><div>> > cache your password. If someone has backdoor shell access then they</div><div><br></div><div><br></div><div>> No. The agent does not cacge the PIN or passphrase - this is done by</div><div>> the smartcard.</div><div><br></div><div><br></div><div dir="ltr" data-setdir="false">OK. I see.</div><div><br></div><div><br></div><div dir="ltr" data-setdir="false"><div><div>> > Otherwise how do you counter the threat of someone gaining backdoor</div><div>> > shell access to your account? That is the threat that the smartcard</div><div>> > ultimately provides the extra protection against.</div></div><br></div><div dir="ltr" data-setdir="false"><br></div><div>> You can't. The smartcard protects your key but it can't really protect</div><div>> the use of the key as long as the smartcard is plugged in.</div><div><br></div><div><br></div><div dir="ltr" data-setdir="false">I don't like that.</div><div dir="ltr" data-setdir="false"><br></div><div><br></div><div>> BTW, Forcing a user to enter the Admin-PIN is pretty easy. Just let the</div><div>> malware use up the the PIN along with some social engineering and most</div><div>> users will enter the Admin PIN to unblock the PIN...</div><div><br></div></div><div><br></div><div dir="ltr" data-setdir="false">However education can protect against that threat. Only ever use the Admin-PIN in the trusted air-gapped machine. Furthermore, if you get your PIN wrong when you know you typed it correctly then that can be a warning that there is some malware on your PC. If you have users of the smartcard that are not very knowledgeable then you can set things up for them so that only you have the Admin-PIN and they need to come to you to unblock the PIN if there is a problem.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Otherwise, how do you guard against the malware / backdoor threat on your PC? Wouldn't the malware just wait for you to plug in the smartcard and enter your passphrase and then proceed to use your key before you can pull out the smartcard? For example, if you use your gpg key for authenticating ssh access then the malware could immediately set up that shell access too.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Thanks for explaining / detailing the treat model better.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Do you think that one of the crypto hardware wallets is a better device to protect against this threat? For example, the Trezor-T has a PIN pad built into the device so you always enter the PIN on the hardware device.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">However, when I looked at the Trezor-T it can only generate the gpg key on the device itself and seems directly dependent on the original seed phrase. This means that the gpg key can be recovered on a new device if the original seed phrase is entered. But, this also means that you can't have a master key with subkeys type of setup where only the subkeys are on the hardware device. There seems to be no way to transfer a gpg subkey to the Trezor-T device.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Maybe it would be possible to enable gnupg use through scanning of QR codes somehow??? Some of the crypto hardware wallets are doing the signing of crypto transactions using QR codes and the device itself remains always air-gapped - it is never actually plugged into a PC. See for example Ngrave. </div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><a href="https://www.ngrave.io/" rel="nofollow" target="_blank" class="enhancr_card_0395151506">NGRAVE | Unrivaled crypto security and seamless experience</a><br></div><div><br></div><div id="ydpf9b66a10enhancr_card_0395151506" class="ydpf9b66a10yahoo-link-enhancr-card ydpf9b66a10ymail-preserve-class ydpf9b66a10ymail-preserve-style" style="max-width:400px;font-family:YahooSans, Helvetica Neue, Segoe UI, Helvetica, Arial, sans-serif" data-url="https://www.ngrave.io/" data-type="YENHANCER" data-size="MEDIUM" contenteditable="false"><a href="https://www.ngrave.io/" style="text-decoration:none !important;color:#000 !important" class="ydpf9b66a10yahoo-enhancr-cardlink" rel="nofollow" target="_blank"><table border="0" class="ydpf9b66a10card-wrapper ydpf9b66a10yahoo-ignore-table" cellpadding="0" cellspacing="0" style="max-width:400px"><tbody><tr><td width="400"><table border="0" class="ydpf9b66a10card ydpf9b66a10yahoo-ignore-table" cellpadding="0" cellspacing="0" width="100%" style="max-width:400px;border-width:1px;border-style:solid;border-color:rgb(224, 228, 233);border-radius:2px"><tbody><tr><td class="ydpf9b66a10card-primary-image-cell" background="https://s.yimg.com/lo/api/res/1.2/QdWD7Y6LJ69rXZL0M4q9cQ--~A/Zmk9ZmlsbDt3PTQwMDtoPTIwMDthcHBpZD1pZXh0cmFjdA--/http://v.fastcdn.co/u/810ecb75/52721256-0-NGRAVE-ZERO.png.cf.jpg" bgcolor="#000000" valign="top" height="175" style="background-color: rgb(0, 0, 0); background-size: cover; position: relative; border-radius: 2px 2px 0px 0px; min-height: 175px;"><!--[if gte mso 9]><v:rect fill="true" stroke="false" style="width:396px;height:175px;position:absolute;top:0;left:0;"><v:fill type="frame" color="#000000" src="https://s.yimg.com/lo/api/res/1.2/QdWD7Y6LJ69rXZL0M4q9cQ--~A/Zmk9ZmlsbDt3PTQwMDtoPTIwMDthcHBpZD1pZXh0cmFjdA--/http://v.fastcdn.co/u/810ecb75/52721256-0-NGRAVE-ZERO.png.cf.jpg"/></v:rect><![endif]--><table border="0" class="ydpf9b66a10card-overlay-container-table ydpf9b66a10yahoo-ignore-table" cellpadding="0" cellspacing="0" style="width:100%"><tbody><tr><td class="ydpf9b66a10card-overlay-cell" background="https://s.yimg.com/cv/ae/nq/storm/assets/enhancrV21/1/enhancr_gradient-400x175.png" bgcolor="transparent" valign="top" style="background-color: transparent; border-radius: 2px 2px 0px 0px; min-height: 175px;"><!--[if gte mso 9]><v:rect fill="true" stroke="false" style="width:396px;height:175px;position:absolute;top:-18px;left:0;"><v:fill type="pattern" color="#000000" src="https://s.yimg.com/cv/ae/nq/storm/assets/enhancrV21/1/enhancr_gradient-400x175.png"/><v:textbox inset="0,0,20px,0"><![endif]--><table border="0" class="ydpf9b66a10yahoo-ignore-table" height="175" style="width: 100%; min-height: 175px;"><tbody><tr><td class="ydpf9b66a10card-richInfo2" style="text-align:left;padding:15px 0 0 15px;vertical-align:top"></td><td class="ydpf9b66a10card-actions" style="text-align:right;padding:15px 15px 0 0;vertical-align:top"><div class="ydpf9b66a10card-share-container"></div></td></tr></tbody></table><!--[if gte mso 9]></v:textbox></v:rect><![endif]--></td></tr></tbody></table></td></tr><tr><td><table border="0" align="center" class="ydpf9b66a10card-info ydpf9b66a10yahoo-ignore-table" cellpadding="0" cellspacing="0" style="background:#fff;position:relative;z-index:2;width:100%;max-width:400px;border-radius:0 0 2px 2px;border-top:1px solid rgb(224, 228, 233)"><tbody><tr><td style="background-color:#ffffff;padding:16px 0 16px 12px;vertical-align:top;border-radius:0 0 0 2px"></td><td style="vertical-align:middle;padding:12px 24px 16px 12px;width:99%;font-family:YahooSans, Helvetica Neue, Segoe UI, Helvetica, Arial, sans-serif;border-radius:0 0 2px 0"><h2 class="ydpf9b66a10card-title" style="font-size: 14px; line-height: 19px; margin: 0px 0px 6px; font-family: YahooSans, Helvetica Neue, Segoe UI, Helvetica, Arial, sans-serif; color: rgb(38, 40, 42); max-width: 314px;">NGRAVE | Unrivaled crypto security and seamless experience</h2><p class="ydpf9b66a10card-description" style="font-size: 12px; line-height: 16px; margin: 0px; color: rgb(151, 155, 167);">The first end-to-end solution for managing your crypto. The Coldest hardware Wallet. The Coldest key back-up. No...</p></td></tr></tbody></table></td></tr></tbody></table></td></tr></tbody></table></a></div><div><br></div><div dir="ltr" data-setdir="false">BTW: I do not have one of these devices and have no association with the company.</div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false"><br></div><div dir="ltr" data-setdir="false">Regards,</div><div dir="ltr" data-setdir="false">Mark.</div><br></div><div><br></div>
</div><div id="yahoo_quoted_0761435162" class="yahoo_quoted">
<div style="font-family:'Helvetica Neue', Helvetica, Arial, sans-serif;font-size:13px;color:#26282a;">
<div>
On Thursday, 7 January 2021, 04:45:11 am AEST, Werner Koch <wk@gnupg.org> wrote:
</div>
<div><br></div>
<div><br></div>
<div><div dir="ltr">On Wed, 6 Jan 2021 15:19, Mark Debian said:<br clear="none"><br clear="none">> After you insert and use your Gnuk token smartcard the gpg-agent will<br clear="none">> cache your password. If someone has backdoor shell access then they<br clear="none"><br clear="none">No. The agent does not cacge the PIN or passphrase - this is done by<br clear="none">the smartcard.<div class="yqt8136169999" id="yqtfd85857"><br clear="none"><br clear="none">> Otherwise how do you counter the threat of someone gaining backdoor<br clear="none">> shell access to your account? That is the threat that the smartcard<br clear="none">> ultimately provides the extra protection against.</div><br clear="none"><br clear="none">You can't. The smartcard protects your key but it can't really protect<br clear="none">the use of the key as long as the smartcard is plugged in.<br clear="none"><br clear="none">BTW, Forcing a user to enter the Admin-PIN is pretty easy. Just let the<br clear="none">malware use up the the PIN along with some social engineering and most<br clear="none">users will enter the Admin PIN to unblock the PIN...<br clear="none"><br clear="none"><br clear="none">Salam-Shalom,<br clear="none"><br clear="none"> Werner<br clear="none"><br clear="none">-- <br clear="none">Die Gedanken sind frei. Ausnahmen regelt ein Bundesgesetz.</div></div>
</div>
</div></body></html>