4 ms·

I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have

I am first time linux mint user. The only place I can find who the developers are/what keys are used/signed and so on is their (compromised) site. Once we have established trust it is easy to maintain it.

berdario 11y ago
You can use gpg on windows or macosx as well to verify the signed hashes. As linked in the blog post in my other comment, tails explains things quite well: https://tails.boum.org/download/index.en.html#verify https://tails.boum.org/download/index.en.html#verify
jnbiche 11y ago
If I had known they had GPG signed hashes, my work flow downloading the distro for the first time during the compromise would have been as follows: 1. Get key id of the key used to sign the hashes. 2. Google for key id. Hmm, no one's used the key id before, that's odd. Not in my web of trust. And it doesn't match the key id mentioned on other forums/scripts/sites. I'll definitely hold off until I can verify the key directly with one of the distro maintainers. Even if you haven't previously established trust, GPG can be an extremely valuable ally.
annnnd 11y ago
True, but the site has to be compromised at the moment you are downloading the keys (not anytime later!), and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore. Ideally, the keys should be distributed in safe fashion too, so this whole question should be moot.
- c22 11y ago
  > ...and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore. Though perhaps more trivial when the attacker has helpfully provided your operating environment.
jmtd 11y ago
The user interface/experience of PGP/GPG is not great, and that could do with fixing. However if you already understood how to use PGP (and granted that's unlikely for the users Mint targets), then you would not have been caught out by this.

berdario 11y ago

You can use gpg on windows or macosx as well to verify the signed hashes. As linked in the blog post in my other comment, tails explains things quite well: https://tails.boum.org/download/index.en.html#verify https://tails.boum.org/download/index.en.html#verify

jnbiche 11y ago

If I had known they had GPG signed hashes, my work flow downloading the distro for the first time during the compromise would have been as follows: 1. Get key id of the key used to sign the hashes. 2. Google for key id. Hmm, no one's used the key id before, that's odd. Not in my web of trust. And it doesn't match the key id mentioned on other forums/scripts/sites. I'll definitely hold off until I can verify the key directly with one of the distro maintainers. Even if you haven't previously established trust, GPG can be an extremely valuable ally.

annnnd 11y ago

True, but the site has to be compromised at the moment you are downloading the keys (not anytime later!), and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore. Ideally, the keys should be distributed in safe fashion too, so this whole question should be moot.

c22 11y ago
> ...and then all your further installations have to me MITM-ed or you would take notice. Not so trivial for attacker anymore. Though perhaps more trivial when the attacker has helpfully provided your operating environment.

jmtd 11y ago

The user interface/experience of PGP/GPG is not great, and that could do with fixing. However if you already understood how to use PGP (and granted that's unlikely for the users Mint targets), then you would not have been caught out by this.