3 ms·

All the .torrent files are served over http so with a simple MITM attack a bad actor could swap in their own custom tweaked version of any data set here in orde

by natch 8y ago

All the .torrent files are served over http so with a simple MITM attack a bad actor could swap in their own custom tweaked version of any data set here in order to achieve whatever goals that might serve for the bad actor's interests. I really wish we could get basic security concepts added to the default curriculum for grade schoolers. You shouldn't need a PhD in computer security to know this stuff. These site creators have PhDs in other fields, but obviously no concept of security. This stuff should be basic literacy for everyone.

westurner 8y ago
> This stuff should be basic literacy for everyone. Arguably, one compromised PKI x.509 CA jeopardizes all SSL/TLS channel sec if there's no certificate pinning and an alternate channel for distributing signed cert fingerprints (cryptographically signed hashes). We could teach blockchain and cryptocurrency principles: private/secret key, public key, hash verification; there there's money on the table. GPG presumes secure key distribution (`gpg --verify .asc`). TUF is designed to survive certain role key compromises. https://theupdateframework.github.io https://theupdateframework.github.io