4 ms·

For the most part you receive the GPG keys over the same TLS connection, though.

by cjbprime 8y ago

sigjuice 8y ago
Not sure what you mean. I don’t think apt-get install foo involves transferring GPG keys.
- cjbprime 8y ago
  We're comparing the security properties of `curl https://somesite.com/foo.sh https://somesite.com/foo.sh | bash` with `curl https://somesite.com/foo.deb` https://somesite.com/foo.deb` and `curl https://somesite.com/apt.key https://somesite.com/apt.key | sudo apt-key add - && sudo apt-get update && sudo apt-get install some-software` I don't think there are very meaningful differences in the security properties -- I don't think it's more difficult to become compromised by one than by one of the others.
  - hueving 8y ago
    No, you're deliberately choosing a bad way to get a key to try to prove your point. You shouldn't be fetching a key from the site that might be compromised.
    - geocar 8y ago
      > You shouldn't be fetching a key from the site that might be compromised. You shouldn't, but people do, and are being directed to do so increasingly as Linux becomes more popular. Software developers want to be software publishers so bad that they're just going to keep pushing, and therein lies the risk: If people get the impression that packages are somehow more secure than shell scripts, then these kinds of attacks will simply become more prevalent. To you it's obvious that packages aren't more secure, it's how you get them that makes their normal use more secure. That's apparently too subtle a point for even big companies like Microsoft. https://pydio.com/en/docs/v8/ed-debianubuntu-systems https://pydio.com/en/docs/v8/ed-debianubuntu-systems https://docs.docker.com/install/linux/docker-ce/ubuntu/#install-docker-ce https://docs.docker.com/install/linux/docker-ce/ubuntu/#inst... https://www.spotify.com/uk/download/linux/ https://www.spotify.com/uk/download/linux/ https://www.elastic.co/guide/en/apm/server/current/setup-repositories.html https://www.elastic.co/guide/en/apm/server/current/setup-rep... https://ring.cx/en/download/gnu-linux https://ring.cx/en/download/gnu-linux http://docs.grafana.org/installation/debian/ http://docs.grafana.org/installation/debian/ https://support.plex.tv/articles/235974187-enable-repository-updating-for-supported-linux-server-distributions/ https://support.plex.tv/articles/235974187-enable-repository... https://stack-of-tasks.github.io/pinocchio/download.html https://stack-of-tasks.github.io/pinocchio/download.html http://download.mantidproject.org/ubuntu.html http://download.mantidproject.org/ubuntu.html https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-apt?view=azure-cli-latest https://docs.microsoft.com/en-us/cli/azure/install-azure-cli... (!!!)
      - dcbadacd 8y ago
        I've always said the same, but what's the solution here?
        geocar 8y ago
        There's three that I can see: 1. Walled Garden: Developers don't self-publish. Call it an app store, call it everything-in-apt. 2. Encapsulate everything so that developers can't do anything. Don't use anything unless it comes in a docker instance. Or a FreeBSD jail. Or something else. Qubes maybe. 3. Smarter users. Good luck with that one.
  - twr 8y ago
    No, there's no effective difference between those examples, apart from maybe post mortem analysis. It's also a poor method of key discovery, as hueving said.
fulafel 8y ago
That's an antipattern, should use keyservers.
- deathanatos 8y ago
  Aren't keyserver lookups usually keyed off a 32-bit key ID though? (Whose space isn't big enough to avoid someone brute-force generating a key with a certain key ID s.t. you think you got the right key.) You're supposed to check the fingerprint, but you need to get the fingerprint, and for that you need a secure channel, and you're right back to square one. For that matter, where did you get the key ID.
- geocar 8y ago
  Where do you get the keyserver ID? From the website? You're back to square one, because anyone can upload anything to a keyserver. If they can modify the website (change files, etc) they can also change the keyserver ID they're telling people to use. The "antipattern" is letting/expecting software developers also be software publishers.
  - twr 8y ago
    This is a good point, which should be brought up more. Although you probably meant key id or key fingerprint, not keyserver ID, which would imply something else. You're supposed to do additional verification of PGP keys, either through attending key signing parties (who does that in 2018?), checking the signatures of people you already trust, or comparing as much out-of-band information as you can. It's not terribly hard to create a plausibly trusted keyring from scratch that depends on only 1 of 3 websites being legitimate. For example: kernel.org: ABAF11C65A2970B130ABE3C479BE3E4300411886 Linus Torvalds <torvalds@kernel.org> marc.info: 647F28654894E3BD457199BE38DBBDC86092693E Greg Kroah-Hartman <gregkh@kernel.org> thunk.org: 3AB057B7E78D945C8C5591FBD36F769BC11804F0 Theodore Ts'o <tytso@mit.edu> All keys are cross signed as shown by gpg2 --list-signatures. If this sounds like a pain in the ass, it's because it is, and GPG could be so much better. Ironically, if you can't acquire the developer's public signing key, it might be best to install software directly from their website, if no trusted repositories are available. If you can acquire their signing key, it's probably best to not install software directly from their website, in order to avoid selective distribution attacks. Sort of unintuitive.
dredmorbius 8y ago
GPG's trust model is outside the transport layer, via signatures. Not foolproof, but it answers your objection.

For the most part you receive the GPG keys over the same TLS connection, though.

sigjuice 8y ago

Not sure what you mean. I don’t think apt-get install foo involves transferring GPG keys.

cjbprime 8y ago
We're comparing the security properties of `curl https://somesite.com/foo.sh https://somesite.com/foo.sh | bash` with `curl https://somesite.com/foo.deb` https://somesite.com/foo.deb` and `curl https://somesite.com/apt.key https://somesite.com/apt.key | sudo apt-key add - && sudo apt-get update && sudo apt-get install some-software` I don't think there are very meaningful differences in the security properties -- I don't think it's more difficult to become compromised by one than by one of the others.
- hueving 8y ago
  No, you're deliberately choosing a bad way to get a key to try to prove your point. You shouldn't be fetching a key from the site that might be compromised.
  - geocar 8y ago
    > You shouldn't be fetching a key from the site that might be compromised. You shouldn't, but people do, and are being directed to do so increasingly as Linux becomes more popular. Software developers want to be software publishers so bad that they're just going to keep pushing, and therein lies the risk: If people get the impression that packages are somehow more secure than shell scripts, then these kinds of attacks will simply become more prevalent. To you it's obvious that packages aren't more secure, it's how you get them that makes their normal use more secure. That's apparently too subtle a point for even big companies like Microsoft. https://pydio.com/en/docs/v8/ed-debianubuntu-systems https://pydio.com/en/docs/v8/ed-debianubuntu-systems https://docs.docker.com/install/linux/docker-ce/ubuntu/#install-docker-ce https://docs.docker.com/install/linux/docker-ce/ubuntu/#inst... https://www.spotify.com/uk/download/linux/ https://www.spotify.com/uk/download/linux/ https://www.elastic.co/guide/en/apm/server/current/setup-repositories.html https://www.elastic.co/guide/en/apm/server/current/setup-rep... https://ring.cx/en/download/gnu-linux https://ring.cx/en/download/gnu-linux http://docs.grafana.org/installation/debian/ http://docs.grafana.org/installation/debian/ https://support.plex.tv/articles/235974187-enable-repository-updating-for-supported-linux-server-distributions/ https://support.plex.tv/articles/235974187-enable-repository... https://stack-of-tasks.github.io/pinocchio/download.html https://stack-of-tasks.github.io/pinocchio/download.html http://download.mantidproject.org/ubuntu.html http://download.mantidproject.org/ubuntu.html https://docs.microsoft.com/en-us/cli/azure/install-azure-cli-apt?view=azure-cli-latest https://docs.microsoft.com/en-us/cli/azure/install-azure-cli... (!!!)
    - dcbadacd 8y ago
      I've always said the same, but what's the solution here?
      - geocar 8y ago
        There's three that I can see: 1. Walled Garden: Developers don't self-publish. Call it an app store, call it everything-in-apt. 2. Encapsulate everything so that developers can't do anything. Don't use anything unless it comes in a docker instance. Or a FreeBSD jail. Or something else. Qubes maybe. 3. Smarter users. Good luck with that one.
- twr 8y ago
  No, there's no effective difference between those examples, apart from maybe post mortem analysis. It's also a poor method of key discovery, as hueving said.

fulafel 8y ago

That's an antipattern, should use keyservers.

deathanatos 8y ago
Aren't keyserver lookups usually keyed off a 32-bit key ID though? (Whose space isn't big enough to avoid someone brute-force generating a key with a certain key ID s.t. you think you got the right key.) You're supposed to check the fingerprint, but you need to get the fingerprint, and for that you need a secure channel, and you're right back to square one. For that matter, where did you get the key ID.
geocar 8y ago
Where do you get the keyserver ID? From the website? You're back to square one, because anyone can upload anything to a keyserver. If they can modify the website (change files, etc) they can also change the keyserver ID they're telling people to use. The "antipattern" is letting/expecting software developers also be software publishers.
- twr 8y ago
  This is a good point, which should be brought up more. Although you probably meant key id or key fingerprint, not keyserver ID, which would imply something else. You're supposed to do additional verification of PGP keys, either through attending key signing parties (who does that in 2018?), checking the signatures of people you already trust, or comparing as much out-of-band information as you can. It's not terribly hard to create a plausibly trusted keyring from scratch that depends on only 1 of 3 websites being legitimate. For example: kernel.org: ABAF11C65A2970B130ABE3C479BE3E4300411886 Linus Torvalds <torvalds@kernel.org> marc.info: 647F28654894E3BD457199BE38DBBDC86092693E Greg Kroah-Hartman <gregkh@kernel.org> thunk.org: 3AB057B7E78D945C8C5591FBD36F769BC11804F0 Theodore Ts'o <tytso@mit.edu> All keys are cross signed as shown by gpg2 --list-signatures. If this sounds like a pain in the ass, it's because it is, and GPG could be so much better. Ironically, if you can't acquire the developer's public signing key, it might be best to install software directly from their website, if no trusted repositories are available. If you can acquire their signing key, it's probably best to not install software directly from their website, in order to avoid selective distribution attacks. Sort of unintuitive.

dredmorbius 8y ago

GPG's trust model is outside the transport layer, via signatures. Not foolproof, but it answers your objection.