Date: Sun, 22 Mar 2015 15:05:18 -0400 From: Daniel Micay <danielmicay@...il.com> To: oss-security@...ts.openwall.com Subject: Re: CVE for Kali Linux On 22/03/15 01:55 PM, Kurt Seifried wrote: > > So in the case of an ISO download that is GPG signed how do I verify the > key is correct? If this is all done over HTTP it is pretty trivial for > an attacker to run a Man in the Middle proxy that string replaces they > key/signature as needed. HTTPS significantly raises this bar, it goes > from "run off the shelf Squid/etc" to "convince a CA to give you a wonky > certificate". It's not this bad for a notable FOSS project if they're willing to put in some work. CryptoCat and the Tor project have their keys pinned here and they're probably in Firefox too (don't feel like checking): https://code.google.com/p/chromium/codesearch#chromium/src/net/http/transport_security_state_static.json If major Linux distributions wanted to put in this effort, they'd have it too. It does mean staying on top of managing certificates, as the pin needs to be dealt with a few months in advance of switching. This can't scale which is the main problem with it, but I doubt that Google or Mozilla would turn away a Linux distribution with a significant userspace if they wanted to do this. There's little doubt that they'd pin a key for Debian or Fedora... and it would allow a sane bootstrap for the distributions GPG keyring. Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.