Basic Opsec Question - Linux

DeletedUser89

Hello,

Like probably many here, on desktop I have been using Linux for a little while, and most of my sensitive documents such as passport copies, my Keepass database (all my passwords), and more are stored on my Linux desktop. On my GOS phone, it's mostly just pictures, my messenger, and some other small things. So, for the most part, I will make online purchases, file taxes, etc., all on my desktop while my phone is a secondary device for comms.

Getting to the point: I'm completely aware of Linux' vulnerabilities, though some being too advanced for me to understand, and I do view my phone as a more "secure" device. In your opinion, would it be smarter to move many of these sensitive documents and activities to my phone, keeping the desktop for more day-to-day hobby stuff? For example, I do know that there is a KeepassDX app for mobile, and that way, I could manage my passwords ONLY on my phone. However, that would make things like typing in a master password rather difficult, and using a key file probably impossible.

I will appreciate any advice given. Thanks!

Que

DeletedUser89 In your opinion, would it be smarter to move many of these sensitive documents and activities to my phone, keeping the desktop for more day-to-day hobby stuff?

In general, no. More secure? Maybe.

GOS and AOSP have numerous security features and models beyond a typical desktop OS, yes. But a typical desktop OS also has numerous benefits. For me, the benefits outweigh the risks.

Managing passwords on a single device would make me nervous. I'd want to make sure my backups were well tested.

Another consideration: Qubes OS. It's a security-focused desktop OS. Still not without its own set of pros and cons though.

de0u

DeletedUser89 Be aware that the current backup system on GrapheneOS, SeedVault, is not a paragon of reliability. So at present moving your primary home for critical things to a GrapheneOS device might not be ideal.

DeletedUser89

EDIT: It would also be interesting to get some insight on how I would perform this change in my personal security. As in, if I do decide to move sensitive docs from my Linux Desktop to my GOS phone, how would I do it? If I'm treating the desktop as "less secure" and potentially "compromised", then wouldn't file transfer through MTP be kind of insecure?

DeletedUser89

Que
I agree, the only way I would be comfortable with the single device model for my passwords is if I'm making scheduled backups, however as the reply below yours has suggested, backups still kind of suck on GOS. Will probably have to wait that one out.

Qubes is great, but I have yet to move.

Thanks for the opinion.

Speeduser7533

I use a cloud password manager on my Linux PCs and my GOS phone.

But I also use a file-based password manager as well, so I don't have all my eggs in one basket.

DeletedUser89

Speeduser7533
That's smart, though I usually avoid cloud stuff, I like the local keeping of files.

LunaticBuzz

I use a file-based pwd manager (KeepassXC) which I used to manually copy across to the phone via USB cable (to be used with KeepassDX). More recently, however, I've taken to copying the file to a secure cloud (Proton) to effect the transfer to other devices. A separate backup copy lives on an old Android phone which has a hardware root of trust, that is locked away and only used for this purpose. A further backup lives on the encrypted external drive which does periodic backups of the main Linux laptop. A yet further copy lives on the "travel" laptop, which gets a wipe & re-install after every trip. Lots of redundant backups!! The main file is on the main laptop, which never leaves the house.

DeletedUser89

LunaticBuzz

That's not a bad system (at least in my opinion). I do a lot of local encrypted backups too, but have not dabbled with any secure cloud services. Will have to look into it. Thanks for reply.