4 ms·
Why do you trust that the signing key actually belongs to the developer? If I were an evil hosting provider I would simply change the key fingerprint displayed
by superuser2 11y ago
Why do you trust that the signing key actually belongs to the developer? If I were an evil hosting provider I would simply change the key fingerprint displayed on the download page.
- p4bl0 11y agoYou have ways of veryfing the ownership of a key: PGP's web of trust or keybase.io for examples.
- throwaway7767 11y agoAlso, assuming you keep the key, it prevents someone from attacking you through this channel in the future. Instead of trusting the distribution channel every time, you just have to trust it once. Not perfect, but surely an improvement. Similar to the SSH security model. Personally I verify keys to the best of my ability on first install, and then only use that key to verify in the future.