[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 22 Mar 2015 15:05:18 -0400
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE for Kali Linux
On 22/03/15 01:55 PM, Kurt Seifried wrote:
>
> So in the case of an ISO download that is GPG signed how do I verify the
> key is correct? If this is all done over HTTP it is pretty trivial for
> an attacker to run a Man in the Middle proxy that string replaces they
> key/signature as needed. HTTPS significantly raises this bar, it goes
> from "run off the shelf Squid/etc" to "convince a CA to give you a wonky
> certificate".
It's not this bad for a notable FOSS project if they're willing to put
in some work. CryptoCat and the Tor project have their keys pinned here
and they're probably in Firefox too (don't feel like checking):
https://code.google.com/p/chromium/codesearch#chromium/src/net/http/transport_security_state_static.json
If major Linux distributions wanted to put in this effort, they'd have
it too. It does mean staying on top of managing certificates, as the pin
needs to be dealt with a few months in advance of switching.
This can't scale which is the main problem with it, but I doubt that
Google or Mozilla would turn away a Linux distribution with a
significant userspace if they wanted to do this. There's little doubt
that they'd pin a key for Debian or Fedora... and it would allow a sane
bootstrap for the distributions GPG keyring.
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
