3 ms·

More like: The sad state of security "journalism". Author doesn't have a clue what they're writing about. Packages are signed with strong hashes. Their signa

More like: The sad state of security "journalism". Author doesn't have a clue what they're writing about. Packages are signed with strong hashes. Their signatures verified in lists that are themselves signed by trusted keys. Images have HTTPS-verifiable, even out-of-band if you have any friends. To say that this is in any way insecure because package transit isn't done over an encrypted link is lunacy. A minor, potential privacy issue maybe but if you're that bothered, mirror the whole repo.

jgome 10y ago
He's talking about ISO images, though.
- oliwarner 10y ago
  Me too (in part, though I missed the word "hash"). Natural collisions exist but it's bloody hard work to force a collision on a modified 800MB binary file. That's well before you consider the group security of torrents (hashed chunks, optional SSL on tracker, etc). It's easier to distract somebody and get physical access to their computer.
  - AgentME 10y ago
    I'm not really following you at all. I just went to download the Ubuntu ISO. Everything was over HTTP, and I was not instructed to use or even offered any gpg signatures. I didn't see anything about hashes (which would need to be signed or offered over HTTPS to mean anything).
    - oliwarner 10y ago
      The page you went through [1], contains this: > Verify your download - If you want to verify the data integrity and authenticity of your Ubuntu download, follow our guide. Learn how to verify [2] › Yes, this could be more prominent. Yes, this download could be offered over SSL. Yes, ubuntu.com should definitely force-on SSL (rather than force-off). But these don't equate to a process that is impossible to securely verify. You can. The SHA and MD5 checksums are both GPG-signed [3]. [1]: http://www.ubuntu.com/download/desktop/thank-you?country=GB&version=16.04&architecture=amd64 http://www.ubuntu.com/download/desktop/thank-you?country=GB&... [2]: http://www.ubuntu.com/download/how-to-verify http://www.ubuntu.com/download/how-to-verify [3]: http://releases.ubuntu.com/16.04/ http://releases.ubuntu.com/16.04/
      - sliken 10y ago
        Heh, kinda amusing to claim you can verify the ISO, then to verify you post 3 URLs that are easy to MiTM because they are not using HTTPS. For those that care I suggest: https://help.ubuntu.com/community/VerifyIsoHowto https://help.ubuntu.com/community/VerifyIsoHowto It's over HTTPs, and mentions both the short finger prints (0xFBB75451 and 0xEFE21092) as well as the full finger prints (C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451 and 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092).
        oliwarner 10y ago
        The hash-GPGs are securely verifiable. The community wiki page is editable. Obvious issues there.
Aaron1011 10y ago
"To say that this is in any way insecure because package transit isn't done over an encrypted link is lunacy." The author was referring specifically to the download page itself. As they correctly point out, the checksums and keys themselves can be modified if the page isn't served securely. As for 'trusted keys', that doesn't help someone downloading the ISO for the first time, who hasn't previously verified a download from that site (how do they know if the key fingerprint is the correct one?)

jgome 10y ago

He's talking about ISO images, though.

oliwarner 10y ago
Me too (in part, though I missed the word "hash"). Natural collisions exist but it's bloody hard work to force a collision on a modified 800MB binary file. That's well before you consider the group security of torrents (hashed chunks, optional SSL on tracker, etc). It's easier to distract somebody and get physical access to their computer.
- AgentME 10y ago
  I'm not really following you at all. I just went to download the Ubuntu ISO. Everything was over HTTP, and I was not instructed to use or even offered any gpg signatures. I didn't see anything about hashes (which would need to be signed or offered over HTTPS to mean anything).
  - oliwarner 10y ago
    The page you went through [1], contains this: > Verify your download - If you want to verify the data integrity and authenticity of your Ubuntu download, follow our guide. Learn how to verify [2] › Yes, this could be more prominent. Yes, this download could be offered over SSL. Yes, ubuntu.com should definitely force-on SSL (rather than force-off). But these don't equate to a process that is impossible to securely verify. You can. The SHA and MD5 checksums are both GPG-signed [3]. [1]: http://www.ubuntu.com/download/desktop/thank-you?country=GB&version=16.04&architecture=amd64 http://www.ubuntu.com/download/desktop/thank-you?country=GB&... [2]: http://www.ubuntu.com/download/how-to-verify http://www.ubuntu.com/download/how-to-verify [3]: http://releases.ubuntu.com/16.04/ http://releases.ubuntu.com/16.04/
    - sliken 10y ago
      Heh, kinda amusing to claim you can verify the ISO, then to verify you post 3 URLs that are easy to MiTM because they are not using HTTPS. For those that care I suggest: https://help.ubuntu.com/community/VerifyIsoHowto https://help.ubuntu.com/community/VerifyIsoHowto It's over HTTPs, and mentions both the short finger prints (0xFBB75451 and 0xEFE21092) as well as the full finger prints (C598 6B4F 1257 FFA8 6632 CBA7 4618 1433 FBB7 5451 and 8439 38DF 228D 22F7 B374 2BC0 D94A A3F0 EFE2 1092).
      - oliwarner 10y ago
        The hash-GPGs are securely verifiable. The community wiki page is editable. Obvious issues there.

Aaron1011 10y ago

"To say that this is in any way insecure because package transit isn't done over an encrypted link is lunacy." The author was referring specifically to the download page itself. As they correctly point out, the checksums and keys themselves can be modified if the page isn't served securely. As for 'trusted keys', that doesn't help someone downloading the ISO for the first time, who hasn't previously verified a download from that site (how do they know if the key fingerprint is the correct one?)