3 ms·
The website is vulnerable in a much larger number of ways, since it involves significantly more infrastructure which is all vulnerable to state actors. A state
by chrisfosterelli 10y ago
The website is vulnerable in a much larger number of ways, since it involves significantly more infrastructure which is all vulnerable to state actors. A state could generate fake certificates, physically access hosting servers, or access the internet connections the website uses.
There is a much smaller attack surface for keys.
If you are talking about protecting the key fingerprint they posted on the website, the idea is by publishing them now that others can note the fingerprint and warning before any malicious actor would have a chance to respond.
This is also the same key they've used in the past I believe, so it can always be compared to prior releases.
- chatmasta 10y agoIs this a good case for distributing downloads via torrent? Or do you then face the same problem when linking to the torrent file?
- chrisfosterelli 10y agoDownloading by torrent hash link is nice because it cannot be altered after release, while this isn't true with a link to a binary file on a website. However, you still have to verify the authenticity of the binary with keys if you don't trust the location you got the torrent hash from (ie, the bitcoin website). So yes, essentially the same problem I believe!
- indolering 10y agoIt also allows them to trace any potential attacks, a state actor would need to get access to the signing machine or the private key itself.
- placeybordeaux 10y agoThats assuming that the current page wasn't altered by the attacker.
- indolering 10y agoWhich is why you check it using multiple VPNs and compare it to the internet archive.