3 ms·
Hmmm, I just had a look there. keyserver.ubuntu.com is available over http as well as https, which means it's probably susceptible to a downgrade attack if you
by bigiain 8y ago
Hmmm, I just had a look there.
keyserver.ubuntu.com is available over http as well as https, which means it's probably susceptible to a downgrade attack if you're mitming it - which would let you serve a bogus public key and therefore generate apparently valid signatures for the hash for a modified ISO.
That's not good...
- cordonbleu 8y agoits happened in variant form already, this is why habits of complacency should be kept in check. remember this ? V https://www.theregister.co.uk/2016/02/21/linux_mint_hacked_malwareinfected_isos_linked_from_official_site/ https://www.theregister.co.uk/2016/02/21/linux_mint_hacked_m...