diff options
| author | Matthias Pigulla <mp@webfactory.de> | 2021-10-25 09:31:57 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-10-25 09:31:57 +0200 |
| commit | 76d32d2cd993fc40e971e4214817a8f702037fda (patch) | |
| tree | d2488eb8f9f5e8242f29833d600e73e07359df86 /README.md | |
| parent | Merge pull request #291 from gaffneyd4/improve-recovery-guide (diff) | |
| download | YubiKey-Guide-76d32d2cd993fc40e971e4214817a8f702037fda.tar.gz | |
Point out that paperkey backups are password-protected
Fixes #263. Really though decision to make whether a paper printout with the password is a good way to go (recoverable but needs a really good place to keep) or not (more protection, but possibly worthless).
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 6 |
1 files changed, 4 insertions, 2 deletions
@@ -951,10 +951,12 @@ The `revoke.asc` certificate file should be stored (or printed) in a (secondary) # Backup -Once keys are moved to YubiKey, they cannot be moved again! Create an **encrypted** backup of the keyring and consider using a [paper copy](https://www.jabberwocky.com/software/paperkey/) of the keys as an additional backup measure. - +Once keys are moved to YubiKey, they cannot be moved again! Create an **encrypted** backup of the keyring on removable media so you can keep it offline in a safe place. + **Tip** The ext2 filesystem (without encryption) can be mounted on both Linux and OpenBSD. Consider using a FAT32/NTFS filesystem for MacOS/Windows compatibility instead. +As an additional backup measure, consider using a [paper copy](https://www.jabberwocky.com/software/paperkey/) of the keys. The [Linux Kernel Maintainer PGP Guide](https://www.kernel.org/doc/html/latest/process/maintainer-pgp-guide.html#back-up-your-master-key-for-disaster-recovery) points out that such printouts *are still password-protected*. It recommends to *write the password on the paper*, since it will be unlikely that you remember the original key password that was used when the paper backup was created. Obviously, you need a really good place to keep such a printout. + **Linux** Attach another external storage device and check its label: |