5 ms·

I'm quite unhappy about this change, as it misrepresents how GPG is supposed to work. The whole point of using signed commits/tags is to not have to trust the G

I'm quite unhappy about this change, as it misrepresents how GPG is supposed to work. The whole point of using signed commits/tags is to not have to trust the Git server... yet by relying on GitHub's "verified" badge, that's precisely what you're doing. This is security theater, and it's going to mislead a ton of people into thinking something has been verified more than it could possibly have been. Signature verification is necessarily something that the client must do, not the server. EDIT: Would the downvoters care to comment?

Kerrick 11y ago
These days the GitHub.com UI is developing into a full-fledged git client. You can branch, commit, merge, move and add files, and more. I see this as another evolution towards GitHub.com as a git client.
- lmm 11y ago
  A git client that's running on hardware you don't control though. One of the golden rules of using GPG is to never run it on any machine except your own.
- joepie91_ 11y ago
  That really doesn't matter. It doesn't run on your own system under your own control, and thus, for security purposes, it can't be considered a client. EDIT: In this case, the 'client' would be your browser.
detaro 11y ago
(I didn't downvote you, but) Just because it doesn't protect against one class of attacks you have decided to be care about it isn't "security theater" if it helps against others. If your threat model includes "I don't trust GitHub/their servers", then yes, you obviously have to verify offline. > it's going to mislead a ton of people into thinking something has been verified more than it could possibly have been What specifically do you think people are going to think has been verified?
- lmm 11y ago
  > If your threat model includes "I don't trust GitHub/their servers", then yes, you obviously have to verify offline. Given that both git and openpgp are designed to be distributed and resistant to attacks on any centralized party, that's a reasonable model to have in your head when checking an openpgp signature on a git commit. > What specifically do you think people are going to think has been verified? That my ultra-paranoid friend John who doesn't even use web browsers has signed commit xyz - that's what I'd think when I checked the signature in command-line git. Whereas seeing the "verified" picture in the GitHub page conforms that John signed commit xyz or some script kiddie found a vulnerability in github's rails app or the US government sent an NSL to GitHub or ... For many threat models that's still a very useful guarantee. But it's a very different guarantee from what you get when checking a gpg signature on a git commit locally, and that can easily be very confusing.
pwnna 11y ago
I didn't downvote you either. I agree with your premise. However, I think using the words "security theatre" is inflammatory and overly pessimistic, which is why you're getting downvoted. Generally the general feeling here on that word has a negative connotation associated with things like the TSA and mandating backdoors (something I agree with). However, I do not believe (and the majority of HN, most likely) that GH is actively being malicious adding this feature in. You do have some points: you should only do GPG verification on machines that you trust. This is true, I think we can all agree. However, you say it may train users to ignore checking locally, which remains to be seen. Further, there are some counter points that you're not considering: (1) this move gives huge publicity to gpg signing of commits, which hopefully encourage more people to sign their commits and tags, which hopefully should promote better security. (2) Absolute trusted hardware is hard to come by these days. At the moment, we do not suspect that Github is actively working against us. We can therefore trust GH to display the correct verified tag, for now. If you want to go down the absolute security route, you'll realize that you absolutely cannot trust your own machines either (at least a majority of us cannot). This brings you to a tricky situation where there is no where safe to run GPG. Then what? I think the pessimistic view you presented shares similar ideologies as the view that iMessage can be easily broken because Apple can simply swap out keys. While I agree that this is a concern, I still think that this move by GH is overall positive, just like iMessage is overall a positive step to secure messaging. Incremental steps are good imo and we'll see where this takes us.
- deleted 11y ago
  [deleted]

Kerrick 11y ago

These days the GitHub.com UI is developing into a full-fledged git client. You can branch, commit, merge, move and add files, and more. I see this as another evolution towards GitHub.com as a git client.

lmm 11y ago
A git client that's running on hardware you don't control though. One of the golden rules of using GPG is to never run it on any machine except your own.
joepie91_ 11y ago
That really doesn't matter. It doesn't run on your own system under your own control, and thus, for security purposes, it can't be considered a client. EDIT: In this case, the 'client' would be your browser.

detaro 11y ago

(I didn't downvote you, but) Just because it doesn't protect against one class of attacks you have decided to be care about it isn't "security theater" if it helps against others. If your threat model includes "I don't trust GitHub/their servers", then yes, you obviously have to verify offline. > it's going to mislead a ton of people into thinking something has been verified more than it could possibly have been What specifically do you think people are going to think has been verified?

lmm 11y ago
> If your threat model includes "I don't trust GitHub/their servers", then yes, you obviously have to verify offline. Given that both git and openpgp are designed to be distributed and resistant to attacks on any centralized party, that's a reasonable model to have in your head when checking an openpgp signature on a git commit. > What specifically do you think people are going to think has been verified? That my ultra-paranoid friend John who doesn't even use web browsers has signed commit xyz - that's what I'd think when I checked the signature in command-line git. Whereas seeing the "verified" picture in the GitHub page conforms that John signed commit xyz or some script kiddie found a vulnerability in github's rails app or the US government sent an NSL to GitHub or ... For many threat models that's still a very useful guarantee. But it's a very different guarantee from what you get when checking a gpg signature on a git commit locally, and that can easily be very confusing.

pwnna 11y ago

I didn't downvote you either. I agree with your premise. However, I think using the words "security theatre" is inflammatory and overly pessimistic, which is why you're getting downvoted. Generally the general feeling here on that word has a negative connotation associated with things like the TSA and mandating backdoors (something I agree with). However, I do not believe (and the majority of HN, most likely) that GH is actively being malicious adding this feature in. You do have some points: you should only do GPG verification on machines that you trust. This is true, I think we can all agree. However, you say it may train users to ignore checking locally, which remains to be seen. Further, there are some counter points that you're not considering: (1) this move gives huge publicity to gpg signing of commits, which hopefully encourage more people to sign their commits and tags, which hopefully should promote better security. (2) Absolute trusted hardware is hard to come by these days. At the moment, we do not suspect that Github is actively working against us. We can therefore trust GH to display the correct verified tag, for now. If you want to go down the absolute security route, you'll realize that you absolutely cannot trust your own machines either (at least a majority of us cannot). This brings you to a tricky situation where there is no where safe to run GPG. Then what? I think the pessimistic view you presented shares similar ideologies as the view that iMessage can be easily broken because Apple can simply swap out keys. While I agree that this is a concern, I still think that this move by GH is overall positive, just like iMessage is overall a positive step to secure messaging. Incremental steps are good imo and we'll see where this takes us.

deleted 11y ago
[deleted]