I’m still new to this so I’m still figuring this out. By default, gpg keys are stored in ~/.gnupg. So, it’s possible for most desktop apps out there to read the private gpg keys, right? Why isn’t this a big issue? What am I missing here? Even if there is some mechanism disallowing them from making use of the key, what if something like a malicious file manager decides to delete the key?
If you install a malicious application, it can do way worse things than reading your keyring. For example, install a keylogger or exfiltrate all your data.
Ultimately, you need to be careful not to install malicious applications to begin with.
Look at it this way - gpg key is your file. It has read/write permission you have and any software you run has this permissions.
If you are afraid something can delete it then remove write permission from it.
If you are afraid something illicit can read it then create a dummy user and set permissions to this user. Access the files with sudo -u command for software that has to access it.
Is this a reasonable way to handle it? Probably not for me.
You can specify a passphrase for gpg key which makes it useless without it.
You’ll be fine as long as you don’t install programs from unknown sources and don’t run scripts that you don’t know what’s inside.
EDIT: Corrected to be correct according to @dalto’s correction. 
1 Like
Programs you run can access your data. This is the basis of the von Neumann architecture.
It is possible to sandbox or virtualise software to limit what it can read and write, but generally it’s not a good idea to run untrusted software.
I fixed that for you. 
The idea that things which don’t need root access are harmless is entirely false. Even without root, a script or application can do really, really nasty stuff.
3 Likes
A nasty script do not need sudo to curl your gpg private key to attacker’s server.
Yes, all files which are in your home folder can be read by software. It’s how the structure is built.
Almost all the software we run is from known sources and if needed anyone can look up what is contained in the source code. Due to being open source lot of eyes go through the code so if there’s any malicious attempt they will be found and reported. Unlike Windows software comes from all over the place Linux has many centralized software centers which are maintained by members of the community who are well trusted.
Nothing I guess.
To stop the files from being read you can use what @vlkon said. When it comes to malicious file managers personally I’m yet to come across one.
malicious file-managers or malicious-file managers? 
4 Likes
Ok thanks all.