bmhatfield

How to use GPG/PGP to share passwords

Sometimes we need to transmit passwords over unsecured channels, like Slack or email. There are lots of password managers, but their password sharing functionality is less robust than I like. For example, 1Password lets you share passwords, but to do so you must share your entire keychain - which is not useful.

To solve this, we can use public/private keys to transmit messages over any channel, that can only be decrypted by the end user. This is stuff of the future! It seems like it would be complicated, but common use cases are very easy to set up and use!

Setup

bmhatfield

# If you use bash, this technique isn't really zsh specific. Adapt as needed.
source ~/keychain-environment-variables.sh

# AWS configuration example, after doing:
# $  set-keychain-environment-variable AWS_ACCESS_KEY_ID
#       provide: "AKIAYOURACCESSKEY"
# $  set-keychain-environment-variable AWS_SECRET_ACCESS_KEY
#       provide: "j1/yoursupersecret/password"
export AWS_ACCESS_KEY_ID=$(keychain-environment-variable AWS_ACCESS_KEY_ID);
export AWS_SECRET_ACCESS_KEY=$(keychain-environment-variable AWS_SECRET_ACCESS_KEY);

bmhatfield

# In order for gpg to find gpg-agent, gpg-agent must be running, and there must be an env
# variable pointing GPG to the gpg-agent socket. This little script, which must be sourced
# in your shell's init script (ie, .bash_profile, .zshrc, whatever), will either start
# gpg-agent or set up the GPG_AGENT_INFO variable if it's already running.

# Add the following to your shell init to set up gpg-agent automatically for every shell
if [ -f ~/.gnupg/.gpg-agent-info ] && [ -n "$(pgrep gpg-agent)" ]; then
    source ~/.gnupg/.gpg-agent-info
    export GPG_AGENT_INFO
else