[jacquesm]

Is it even safe to discuss where you store your keys and how you protect them? That's halfway into a social engineering step, and sure, that's a bit of 'security by obscurity' but if I asked you where do you keep the spare keys to your house would you be comfortable answering that if you were identifiable?

[danellis]

If you're not comfortable answering that, perhaps it's a sign that you should be keeping them somewhere more secure.

[jacquesm]

I don't agree with that. It could be as secure as could be, but I'd still be pointing at the keys and that's information that no outsider needs to have. Why give that up? It saves them from having to look for the keys, they can now set up a targeted attack on obtaining the keys because their location is already known and that's half the battle.

[Terribledactyl]

Yes, not knowing where to even start the attack does make it more difficult to complete an attack. But, there is no way it could make it easier. I mean adding plastic wrap around your safe does technically make it more difficult to break into, but the issue comes where you come to rely on it. My safe is 100% uncrackable, as long as it doesn't get wet, thanks plastic wrap.

[jacquesm]

That's not the question though. The question is 'where do you keep the key to your safe'?

[gh02t]

Hopefully it's more like "what kind of safe do you keep the keys to your other safe in?"

I think the point is in relying on something that is fundamentally secure, not secure because it is obscure. If I print my private key on a piece of paper and pin it up by my desk that's something I shouldn't tell people, but if I have it locked in an unspecified safe deposit box, there isn't much harm in describing what the deposit box is made out of.

It does make you less secure, but a good security plan starts from assuming your adversary knew all that sort of thing in the first place.

[INTPenis]

I see by the top comments that in the end the responsibility still falls on human discipline. At least two people have already confessed to having no passphrase on their SSH keys and promising that they lock their laptop screen when leaving it unsupervised. This is very insecure regardless of disk encryption.

[bcook]

I agree that it may decrease the security of the individual by sharing their particular security practices, but sharing good information may benefit the group.

Thanks for asking the question.