4 ms·

GPG signatures are kinda useless (when hosted on the same server). If I am able to replace the download I could probably deface also the pages where you give yo

GPG signatures are kinda useless (when hosted on the same server). If I am able to replace the download I could probably deface also the pages where you give your signature and key fingerprint.

jnbiche 11y ago
The point of GPG is to download the public key of the signer (in this case, the package maintainer). Then, you check it's bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.). After that, you have a trusted signature, and it doesn't matter if it the signature page is defaced. If you're downloading the signature each time you're downloading a new version of a package or iso, and its SHAs, you're using GPG incorrectly. I've had many signatures for package signers in my keyring for 5+ years. If and when they replace the key, they let the community know and we update our keyrings. Yes, if you don't want to do that, fine, but for those of us who are careful users of GPG, it's a huge barrier against malware in packages and distros.
- venomsnake 11y ago
  I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.
  - berdario 11y ago
    You can use gpg on windows or macosx as well to verify the signed hashes. As linked in the blog post in my other comment, tails explains things quite well: https://tails.boum.org/download/index.en.html#verify https://tails.boum.org/download/index.en.html#verify
  - jnbiche 11y ago
    If I had known they had GPG signed hashes, my work flow downloading the distro for the first time during the compromise would have been as follows: 1. Get key id of the key used to sign the hashes. 2. Google for key id. Hmm, no one's used the key id before, that's odd. Not in my web of trust. And it doesn't match the key id mentioned on other forums/scripts/sites. I'll definitely hold off until I can verify the key directly with one of the distro maintainers. Even if you haven't previously established trust, GPG can be an extremely valuable ally.
  - annnnd 11y ago
    True, but the site has to be compromised at the moment you are downloading the keys (not anytime later!), and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore. Ideally, the keys should be distributed in safe fashion too, so this whole question should be moot.
    - c22 11y ago
      > ...and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore. Though perhaps more trivial when the attacker has helpfully provided your operating environment.
  - jmtd 11y ago
    The user interface/experience of PGP/GPG is not great, and that could do with fixing. However if you already understood how to use PGP (and granted that's unlikely for the users Mint targets), then you would not have been caught out by this.
- pferde 11y ago
  "If you're downloading the signature each time you're downloading a new version of a package or iso, and its SHAs, you're using GPG incorrectly." I believe you're confusing a PGP public key with a PGP signature for a particular file (made using said public key).
  - jnbiche 11y ago
    Thank you, that was indeed a typo I wrote as I rushed to get out the door earlier. I obviously meant to write "if you're downloading the public key" (indeed, I referred to "download the public key of the signer" in two paragraphs up, so I suspect that was clear to most people reading). The hashes for each new version are what are signed, obviously (with the private key of the maintainer). My sentence about "trusted signature" could have been clearer, too. You have a public key that you trust, that you leverage to verify any new materials signed by the package/distro maintainer. So by extension, you can trust the signed hashes. I've been using PGP/GPG on a regular basis since 1998, so I'm pretty used to the workflow by now and not at all confused about key pairs and signatures (although I will admit that I sometimes got confused about the point of subkeys until I read this a few years ago: https://alexcabal.com/creating-the-perfect-gpg-keypair/ https://alexcabal.com/creating-the-perfect-gpg-keypair/)
    - pferde 11y ago
      Yeah, I figured out that you merely made a simple mistake, since rest of your comment makes all kinds of sense. :) Apologies in case I sounded like I wanted to put you down.
ajdlinux 11y ago
APT can automatically verify GPG signatures against a preinstalled keyring. Obviously, that doesn't help in the case of this particular incident (ISOs), but it does help in day-to-day updates.
- jnbiche 11y ago
  Not sure why this was downvoted, since it's true. apt does this by default, in fact. GPG is immensely useful for securely distributing packages and distros.

GPG signatures are kinda useless (when hosted on the same server). If I am able to replace the download I could probably deface also the pages where you give your signature and key fingerprint.

jnbiche 11y ago

The point of GPG is to download the public key of the signer (in this case, the package maintainer). Then, you check it's bona fide, either by verifying that you have a trusted connection through your web of trust, or (more likely) by verifying the key id is mentioned in other trustworthy places (like legitimate Ansible and Bash scripts, etc.). After that, you have a trusted signature, and it doesn't matter if it the signature page is defaced. If you're downloading the signature each time you're downloading a new version of a package or iso, and its SHAs, you're using GPG incorrectly. I've had many signatures for package signers in my keyring for 5+ years. If and when they replace the key, they let the community know and we update our keyrings. Yes, if you don't want to do that, fine, but for those of us who are careful users of GPG, it's a huge barrier against malware in packages and distros.

venomsnake 11y ago
I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.
- berdario 11y ago
  You can use gpg on windows or macosx as well to verify the signed hashes. As linked in the blog post in my other comment, tails explains things quite well: https://tails.boum.org/download/index.en.html#verify https://tails.boum.org/download/index.en.html#verify
- jnbiche 11y ago
  If I had known they had GPG signed hashes, my work flow downloading the distro for the first time during the compromise would have been as follows: 1. Get key id of the key used to sign the hashes. 2. Google for key id. Hmm, no one's used the key id before, that's odd. Not in my web of trust. And it doesn't match the key id mentioned on other forums/scripts/sites. I'll definitely hold off until I can verify the key directly with one of the distro maintainers. Even if you haven't previously established trust, GPG can be an extremely valuable ally.
- annnnd 11y ago
  True, but the site has to be compromised at the moment you are downloading the keys (not anytime later!), and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore. Ideally, the keys should be distributed in safe fashion too, so this whole question should be moot.
  - c22 11y ago
    > ...and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore. Though perhaps more trivial when the attacker has helpfully provided your operating environment.
- jmtd 11y ago
  The user interface/experience of PGP/GPG is not great, and that could do with fixing. However if you already understood how to use PGP (and granted that's unlikely for the users Mint targets), then you would not have been caught out by this.
pferde 11y ago
"If you're downloading the signature each time you're downloading a new version of a package or iso, and its SHAs, you're using GPG incorrectly." I believe you're confusing a PGP public key with a PGP signature for a particular file (made using said public key).
- jnbiche 11y ago
  Thank you, that was indeed a typo I wrote as I rushed to get out the door earlier. I obviously meant to write "if you're downloading the public key" (indeed, I referred to "download the public key of the signer" in two paragraphs up, so I suspect that was clear to most people reading). The hashes for each new version are what are signed, obviously (with the private key of the maintainer). My sentence about "trusted signature" could have been clearer, too. You have a public key that you trust, that you leverage to verify any new materials signed by the package/distro maintainer. So by extension, you can trust the signed hashes. I've been using PGP/GPG on a regular basis since 1998, so I'm pretty used to the workflow by now and not at all confused about key pairs and signatures (although I will admit that I sometimes got confused about the point of subkeys until I read this a few years ago: https://alexcabal.com/creating-the-perfect-gpg-keypair/ https://alexcabal.com/creating-the-perfect-gpg-keypair/)
  - pferde 11y ago
    Yeah, I figured out that you merely made a simple mistake, since rest of your comment makes all kinds of sense. :) Apologies in case I sounded like I wanted to put you down.

ajdlinux 11y ago

APT can automatically verify GPG signatures against a preinstalled keyring. Obviously, that doesn't help in the case of this particular incident (ISOs), but it does help in day-to-day updates.

jnbiche 11y ago
Not sure why this was downvoted, since it's true. apt does this by default, in fact. GPG is immensely useful for securely distributing packages and distros.