4 ms·

Why don't we have signing keys for publishers yet?

by ezekg 5y ago

sebazzz 5y ago
Why don't we force two factor auth for publishers?
- yodon 5y ago
  Npm is owned by Microsoft. If they forced 2FA on all npm publishers as you propose the anti-MSFT wing of the coding community would go ballistic convinced it was an evil master plan to extinguish open source forever.
_jal 5y ago
Absolutely agree that it is disturbing that this isn't a priority. Necessary, but still not sufficient - I suspect the attack model will just move to buying/stealing keys.
- d4mi3n 5y ago
  Still an improvement. Keys can be revoked and regenerated.
  - Joker_vD 5y ago
    So can be the published packages? And the developer accounts' passwords?
    - d4mi3n 5y ago
      Revoking the keys makes whatever existing artifacts and packages signed with old keys fail integrity checks. Revoking the published packages and rotating compromised passwords should certainly also be done, but neither of those stop packages in mirrored or present in local caches from being used without further intervention (assuming your packaging ecosystem regularly verifies packages have valid signatures, which sadly I know ecosystems like NPM do not).
Joker_vD 5y ago
There are loads of signed malware: in fact, that's how you know it's of genuinely good quality.
Tajnymag 5y ago
We could, but those keys can be stolen as well. As long as the signing is, for example, done through an automated CI/CD, the keys would only work as a second stronger password. What might work would be an interactive two factor authentication similar to how Microsoft or Google does it. Every time a release to the package repository was awaiting, the author would get push notification to their primary device and it would have to be approved manually.
- Joker_vD 5y ago
  Well, duh: the release of a package should require a confirmation from the authorized human, delivered via a safe channel.
verdverm 5y ago
https://sigstore.dev https://sigstore.dev is infra for doing this similar to how SSL certs work.

Why don't we have signing keys for publishers yet?

by ezekg 5y ago

Why don't we have signing keys for publishers yet?

sebazzz 5y ago

Why don't we force two factor auth for publishers?

yodon 5y ago
Npm is owned by Microsoft. If they forced 2FA on all npm publishers as you propose the anti-MSFT wing of the coding community would go ballistic convinced it was an evil master plan to extinguish open source forever.

_jal 5y ago

Absolutely agree that it is disturbing that this isn't a priority. Necessary, but still not sufficient - I suspect the attack model will just move to buying/stealing keys.

d4mi3n 5y ago
Still an improvement. Keys can be revoked and regenerated.
- Joker_vD 5y ago
  So can be the published packages? And the developer accounts' passwords?
  - d4mi3n 5y ago
    Revoking the keys makes whatever existing artifacts and packages signed with old keys fail integrity checks. Revoking the published packages and rotating compromised passwords should certainly also be done, but neither of those stop packages in mirrored or present in local caches from being used without further intervention (assuming your packaging ecosystem regularly verifies packages have valid signatures, which sadly I know ecosystems like NPM do not).

Joker_vD 5y ago

There are loads of signed malware: in fact, that's how you know it's of genuinely good quality.

Tajnymag 5y ago

We could, but those keys can be stolen as well. As long as the signing is, for example, done through an automated CI/CD, the keys would only work as a second stronger password. What might work would be an interactive two factor authentication similar to how Microsoft or Google does it. Every time a release to the package repository was awaiting, the author would get push notification to their primary device and it would have to be approved manually.

Joker_vD 5y ago
Well, duh: the release of a package should require a confirmation from the authorized human, delivered via a safe channel.

verdverm 5y ago

https://sigstore.dev https://sigstore.dev is infra for doing this similar to how SSL certs work.