5 ms·

It always makes me sad to see that the PuTTY download page is served over unsecure HTTP.

by hughes 10y ago

agumonkey 10y ago
I wonder why it's still the case. Lack of resources to enable HTTPS ? lack of manpower ? ..
r1ch 10y ago
At least the binaries are authenticode signed now, so checking they are legit is just a right click away.
- anderskaseorg 10y ago
  How is that supposed to help? Even if the legitimate binaries are Authenticode-signed now, a malicious non-Authenticode-signed binary substituted by an attacker MITMing the insecure HTTP connection will appear to the downloader to look just like the legitimate non-Authenticode-signed binaries of previous versions that they’ve been downloading for years.
  - Godel_unicode 10y ago
    Because you can add the signing cert to your AppLocker whitelist, and now it will be checked every time it runs. Then you push that out by GPO, and now everyone has that same whitelist protection. Also, as mentioned other places on the thread, the downloads are over HTTPS. Edit: see the following https://technet.microsoft.com/en-us/library/dd723683(v=ws.10).aspx https://technet.microsoft.com/en-us/library/dd723683(v=ws.10...
- morecoffee 10y ago
  Right clicking is one click too many. Wouldn't it be better to get the binary securely in the first place?
niftich 10y ago
But the downloads themselves aren't -- those are served out of https://the.earth.li/~sgtatham/putty/0.68/ https://the.earth.li/~sgtatham/putty/0.68/ For later reference, here's some sha512sum excerpts for version 0.68: ea03a52d344699c10e66e4f0424fba2b31d13d00ed24e1822c8ebe80fa589ce862419e5e852d6e1cb986637ea4e04d6cbe5ff3f1171ca403c9e55681877a712d w32/putty.zip 71c98de058e3f3fda9558cea955a5da28f41ae45464cafe9ea0b22ecf8cfeb56b1b047fb4b694b0c8e7c230f631dce9dd5bad26d70240b07b64ba27c3500d1fb w32/putty.exe 2b6b1acc51fc9cfe8a08e17afc4ac7d962af4575d55806456aa1a42c563f14457cc81d7e625191fd856b4be9a0e885cef78da4018d542010eba18718bb73fecd w32/putty-0.68-installer.msi debceaa83bb48e7adcc99d03bf152f599477bf960da8c7ea3924925ac5322a9470c4254285d6ff403ad5da78c4c19c25ea5b0c1da45c61d9f0b306b16d0d28f7 w64/putty.zip 29d47c1f5a51e9d59720ccea8eacc317f4b8b839c71f957db713e62d2a9526502fefc01855be97e9e8020d1f343a6a14346a21f4843c12d93ee038a8f9810966 w64/putty.exe 8262c133e3569dcc188e5ac2360ebd3cc09d9edd2f78d6eaaf0e2762fba511de07ce614ba4fedf5f62fe64dd17d5a626dc63a579ee1fc1ef90f45e9e1f0c3d06 w64/putty-64bit-0.68-installer.msi aacd9ec017e3cf56924d75d69f1610512662630c699ee09b4d9012f4e34e608b5b335444cf2529bcfe9c4edbded1c7247338d859385108544b27eeeb74d505c6 putty-src.zip
- anderskaseorg 10y ago
  And obviously a network attacker would never think to modify the insecurely served downloads page to point to a different download URL.
  - niftich 10y ago
    This is a possibility. But downloads have been served out of "the.earth.li/~sgtatham/putty/" for years. Yes, it's owned by someone else and exploding turtles all the way down [1], but now that "the.earth.li/~sgtatham/putty/" is HTTPS, the checksums are properly authentic as attested by the same operator as the one who has supplied PuTTY downloads for years. I've mirrored the most important checksums here, another HTTPS site, so that if any of them ever differ you know to distrust the files. [1] https://news.ycombinator.com/item?id=7334269 https://news.ycombinator.com/item?id=7334269
    - tyrust 10y ago
epalm 10y ago
At this point it's totally inexcusable. Just buy the SSL cert already, or get a free one from Let's Encrypt.
- Godel_unicode 10y ago
  Note the "s". TLS 1.2, AES 256 GCM, ECDHE_RSA. Hard to ask for more than that. https://the.earth.li/~sgtatham/putty/0.68/ https://the.earth.li/~sgtatham/putty/0.68/
  - vacri 10y ago
    The only "s" I see is in 'sgtatham' and 'releases'. If the webpage that lists the link is unsecured, who's to say that the listed links are valid? http://www.chiark.greenend.org.uk/~sgtatham/putty/releases/0.68.html http://www.chiark.greenend.org.uk/~sgtatham/putty/releases/0...
epalm 10y ago
Reminds me of this article posted back in 2014 by Chris Palmer https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/ https://noncombatant.org/2014/03/03/downloading-software-saf...

It always makes me sad to see that the PuTTY download page is served over unsecure HTTP.

by hughes 10y ago

It always makes me sad to see that the PuTTY download page is served over unsecure HTTP.

agumonkey 10y ago

I wonder why it's still the case. Lack of resources to enable HTTPS ? lack of manpower ? ..

r1ch 10y ago

At least the binaries are authenticode signed now, so checking they are legit is just a right click away.

anderskaseorg 10y ago
How is that supposed to help? Even if the legitimate binaries are Authenticode-signed now, a malicious non-Authenticode-signed binary substituted by an attacker MITMing the insecure HTTP connection will appear to the downloader to look just like the legitimate non-Authenticode-signed binaries of previous versions that they’ve been downloading for years.
- Godel_unicode 10y ago
  Because you can add the signing cert to your AppLocker whitelist, and now it will be checked every time it runs. Then you push that out by GPO, and now everyone has that same whitelist protection. Also, as mentioned other places on the thread, the downloads are over HTTPS. Edit: see the following https://technet.microsoft.com/en-us/library/dd723683(v=ws.10).aspx https://technet.microsoft.com/en-us/library/dd723683(v=ws.10...
morecoffee 10y ago
Right clicking is one click too many. Wouldn't it be better to get the binary securely in the first place?

niftich 10y ago

But the downloads themselves aren't -- those are served out of https://the.earth.li/~sgtatham/putty/0.68/ https://the.earth.li/~sgtatham/putty/0.68/ For later reference, here's some sha512sum excerpts for version 0.68: ea03a52d344699c10e66e4f0424fba2b31d13d00ed24e1822c8ebe80fa589ce862419e5e852d6e1cb986637ea4e04d6cbe5ff3f1171ca403c9e55681877a712d w32/putty.zip 71c98de058e3f3fda9558cea955a5da28f41ae45464cafe9ea0b22ecf8cfeb56b1b047fb4b694b0c8e7c230f631dce9dd5bad26d70240b07b64ba27c3500d1fb w32/putty.exe 2b6b1acc51fc9cfe8a08e17afc4ac7d962af4575d55806456aa1a42c563f14457cc81d7e625191fd856b4be9a0e885cef78da4018d542010eba18718bb73fecd w32/putty-0.68-installer.msi debceaa83bb48e7adcc99d03bf152f599477bf960da8c7ea3924925ac5322a9470c4254285d6ff403ad5da78c4c19c25ea5b0c1da45c61d9f0b306b16d0d28f7 w64/putty.zip 29d47c1f5a51e9d59720ccea8eacc317f4b8b839c71f957db713e62d2a9526502fefc01855be97e9e8020d1f343a6a14346a21f4843c12d93ee038a8f9810966 w64/putty.exe 8262c133e3569dcc188e5ac2360ebd3cc09d9edd2f78d6eaaf0e2762fba511de07ce614ba4fedf5f62fe64dd17d5a626dc63a579ee1fc1ef90f45e9e1f0c3d06 w64/putty-64bit-0.68-installer.msi aacd9ec017e3cf56924d75d69f1610512662630c699ee09b4d9012f4e34e608b5b335444cf2529bcfe9c4edbded1c7247338d859385108544b27eeeb74d505c6 putty-src.zip

anderskaseorg 10y ago
And obviously a network attacker would never think to modify the insecurely served downloads page to point to a different download URL.
- niftich 10y ago
  This is a possibility. But downloads have been served out of "the.earth.li/~sgtatham/putty/" for years. Yes, it's owned by someone else and exploding turtles all the way down [1], but now that "the.earth.li/~sgtatham/putty/" is HTTPS, the checksums are properly authentic as attested by the same operator as the one who has supplied PuTTY downloads for years. I've mirrored the most important checksums here, another HTTPS site, so that if any of them ever differ you know to distrust the files. [1] https://news.ycombinator.com/item?id=7334269 https://news.ycombinator.com/item?id=7334269
  - tyrust 10y ago

epalm 10y ago

At this point it's totally inexcusable. Just buy the SSL cert already, or get a free one from Let's Encrypt.

Godel_unicode 10y ago
Note the "s". TLS 1.2, AES 256 GCM, ECDHE_RSA. Hard to ask for more than that. https://the.earth.li/~sgtatham/putty/0.68/ https://the.earth.li/~sgtatham/putty/0.68/
- vacri 10y ago
  The only "s" I see is in 'sgtatham' and 'releases'. If the webpage that lists the link is unsecured, who's to say that the listed links are valid? http://www.chiark.greenend.org.uk/~sgtatham/putty/releases/0.68.html http://www.chiark.greenend.org.uk/~sgtatham/putty/releases/0...

epalm 10y ago

Reminds me of this article posted back in 2014 by Chris Palmer https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/ https://noncombatant.org/2014/03/03/downloading-software-saf...