Ever since we have taken the internet seriously, and maybe even before that, we have been tasked with the responsibility of taking care of our data. Databases, email communication, contacts, files and passwords. One thing that has been since day one, has been the use of encryption to secure all these. Even when we didn't actively use it, our email provider will need to have your email client set up in a way that ensures that your email has being secured, websites were heavily enforced to use the httpS protocol, and even Sysadmins were forced to go from Telnet to SSH.
But most of the regular people, still foreign to security, they do a very lousy work with passwords and they only complain when their data is completely broken and their account de-phased and even then they still go back to their bad practice like re-using passwords or having very simple ones.
But take that to other levels and the way they configure applications, install systems and take care of their media is even worst. But now we will talk on probably the first steps into taking security seriously. That is, to get yourself a PGP key. Linux users, at least some, learn about the importance of PGP keys as they need to hold them to set up their package managers. Having the public signature of developer rings is important to have their packages installed securely which is not a choice on many systems like Debian or distros that have you configure everything from scratch like Arch. But other OS people are completely oblivious to the threat, and the importance of cryptography on everything.
This article is to get you started on how PGP is important and what it is. PGP stand for Pretty Good Privacy and is the process of having a asynchronous key exchange in order to encrypt things like messages, or files. A PGP key will encrypt the access on everything from a text file, to a binary file, rendering it useless unless you have a key. This is similar to the attacks that happened a few years back with Bitlocker and how many organizations got their data encrypted as ransomware.
Encryption is not bad, but not handling encryption correctly is like not handling secure locks, you can get locked out and would be nearly impossible to get yourself back to your data. So it should be taken care, with care.
A key in PGP revolves around your email, your email is your identity or username, from that identity a public key and a private key will be offered. This is similar to how Bitcoin public key or address and a private key or seed are formed. The key will be associated with your email and will show your name and address, as well as KeyID, status of the key, timestamp for generation of the key and validity if it has one.
The PGP software will act as a keychain or key manager that will hold your keys and the public key of third parties. As you will need to use it in exchange with other people or email. A good example to understand both parties, would be to use it between two emails you own. Let say your gmail and a more secure address like protonmail or from a different provider.
The first step would be to generate a key, an application such as kleopatra or Gpg4win work quite similar and can go through the creation process through a wizard. It will ask you to create a personal OpenPGP key pair, ask for your name email and comment (description). Then a passphrase and then it will generate it. You would only need to be careful once is done, and save the private key in a safe place. Meaning a backup place.
Once you have done it with both, you will then do the test of how the keys would work. I will have to write this on a secondary article as this one is taking way too long to create. If you can't wait you can just check the documentation tutorial on it here.