6 ms·

The research article cited in the announcement is titled "PGP signatures on PyPI: worse than useless." That's the issue. Pretending there is a security solutio

by sowbug 3y ago

The research article cited in the announcement is titled "PGP signatures on PyPI: worse than useless." That's the issue. Pretending there is a security solution in place is worse than being upfront that there is none. If you look down and notice that your seatbelt is actually made out of angel hair pasta, you might drive more carefully. Hopefully you'll also get a better car.

rwmj 3y ago
But they're not "worse than useless", that article was wrong. PGP/GPG are without doubt problematic, they have weak points (like use of SHA-1, some keys that could not be located, and terrible UI) but they are not worse than having no traceability of the package at all between the author and PyPI.
- bandrami 3y ago
  It's like the larger holy war against self-signed certificates in TLS. They are strictly better than plaintext but there is software that will prefer a plaintext connection to self-signed TLS.
  - Avamander 3y ago
    Unverifiable security is not "strictly better" than plaintext.
    - bandrami 3y ago
      It is. In both cases you may be MiTMed, but with plaintext that MiTM session may also be eavesdropped upon. This isn't really debateable. Unverified sig simply is strictly better.
      - Avamander 3y ago
        In both cases you can be eavesdropped upon. It really isn't debatable indeed, unverifiable security is not security.
        bandrami 3y ago
        Nope. An unverified TLS session still cannot be examined by a third party. You know you are communicating with exactly one party, even if you don't know who that is. Your attacker may share the data with a third party, but that's true of verified connections too.
        Avamander 3y ago
        > even if you don't know who that is Thus it can be the eavesdropper, easy.
        bandrami 3y ago
        Exactly, the eavesdropper. Even if you're being MiTMd by a criminal organization, you aren't also being listened to by the NSA.
        woodruffw 3y ago
        "Private chat with the devil" is not a useful security model for most web sessions, and it's certainly not suitable for codesigning. Authenticity is the property we're aiming for; if it was just integrity, we'd do nothing at all other than provide digests.
        bandrami 3y ago
        "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense.
        woodruffw 3y ago
        > "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense. I'm sorry, but this is either incorrect or a gross misunderstanding of your own threat model. Most people treat their online self as an extension of their physical self: that means banking information, private personal details, intimate communications, and everything else that's normally private by virtue of physical ownership needs to go through an authenticated channel. You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records.
- woodruffw 3y ago
  > they are not worse than having no traceability of the package at all between the author and PyPI. Except that they are: PGP does not give you this kind of identity relationship. The most it can give you is an association to a key ID, which is (1) brute-forceable, and (2) not strongly bound to any actual user or machine identity. The only thing worse than an unsecured scheme is an insecure scheme that lulls users into a false sense of security and authenticity. PGP signatures on PyPI are the latter.
  - upofadown 3y ago
    >The most it can give you is an association to a key ID, which is (1) brute-forceable This is false. That would mean brute forcing a 160 bit SHA-1 hash. That is not possible.
    - woodruffw 3y ago
      This is wrong on every conceivable level: 1. Key IDs are 32-bit truncations of the SHA-1 hash. That means 32 bits of state, not 160. Fake key IDs are observable in the wild[1]. 2. You're confusing pre-image resistance with collision resistance. SHA-1 has been publicly vulnerable to practical collision attacks since 2017[2]. [1]: https://www.phoronix.com/news/Short-PGP-Collision-Attacks https://www.phoronix.com/news/Short-PGP-Collision-Attacks [2]: https://shattered.io/ https://shattered.io/
      - upofadown 3y ago
        OK, you are talking about the 64 bit keyID. The 32 bit keyIDs are no longer used for the reason you state. Shattered is about SHA-1 use in key signatures. It has nothing to do with keyIDs.
- sowbug 3y ago
  The system guaranteed that a key signed a package. That was its entire utility. At best, it defeated plausible deniability for package maintainers who had avowed public keys, but then somehow signed a bad package. This wouldn't have stopped the malware from getting onto your system. It only would have led you to the hapless (but honest) package maintainer. It didn't stop someone who is not you from generating a PGP key for Richard WM Jones, signing malware, uploading to PyPi, and then disappearing back under the rock where they live. And if you believe this system is not useless, then you also believe that at least one person out there was not dissuaded from installing that malware because "Hey, someone named Richard WM Jones went through the trouble of signing it!" As is often the case, the value of this system depends on your threat model. I'm not too worried about someone going rogue from the tiny population of people who were using PGP correctly. But I am worried about using a platform that claimed to have signing infrastructure, when that infrastructure had no meaningful checks on who was signing.
speedgoose 3y ago
The article is closer to a blog post than a multiple authors peer reviewed research paper published in a high impact journal.
- woodruffw 3y ago
  That's because it is a blog post. It isn't advertised as anything else.
  - donaldstufft 3y ago
    I wonder if the domain being `blog.pypi.org` tipped them off?
im3w1l 3y ago
I think another thing with pgp is that it's in this awkward place where it's bad enough that few people use it, but good enough that it prevents someone from making an alternative.
- akerl_ 3y ago
  Nobody's making a PGP alternative because a major part of what makes PGP bad is that it tries to be a generic solution to every problem, when in practice signing and encryption workflows are incredibly domain-specific. People are continuously creating better tools for domains that historically saw PGP usage. To name a few: Signal for short-form messaging, age for file encryption, signify/minisign for artifact signing.

by sowbug 3y ago

rwmj 3y ago

But they're not "worse than useless", that article was wrong. PGP/GPG are without doubt problematic, they have weak points (like use of SHA-1, some keys that could not be located, and terrible UI) but they are not worse than having no traceability of the package at all between the author and PyPI.

bandrami 3y ago
It's like the larger holy war against self-signed certificates in TLS. They are strictly better than plaintext but there is software that will prefer a plaintext connection to self-signed TLS.
- Avamander 3y ago
  Unverifiable security is not "strictly better" than plaintext.
  - bandrami 3y ago
    It is. In both cases you may be MiTMed, but with plaintext that MiTM session may also be eavesdropped upon. This isn't really debateable. Unverified sig simply is strictly better.
    - Avamander 3y ago
      In both cases you can be eavesdropped upon. It really isn't debatable indeed, unverifiable security is not security.
      - bandrami 3y ago
        Nope. An unverified TLS session still cannot be examined by a third party. You know you are communicating with exactly one party, even if you don't know who that is. Your attacker may share the data with a third party, but that's true of verified connections too.
        Avamander 3y ago
        > even if you don't know who that is Thus it can be the eavesdropper, easy.
        bandrami 3y ago
        Exactly, the eavesdropper. Even if you're being MiTMd by a criminal organization, you aren't also being listened to by the NSA.
        woodruffw 3y ago
        "Private chat with the devil" is not a useful security model for most web sessions, and it's certainly not suitable for codesigning. Authenticity is the property we're aiming for; if it was just integrity, we'd do nothing at all other than provide digests.
        bandrami 3y ago
        "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense.
        woodruffw 3y ago
        > "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense. I'm sorry, but this is either incorrect or a gross misunderstanding of your own threat model. Most people treat their online self as an extension of their physical self: that means banking information, private personal details, intimate communications, and everything else that's normally private by virtue of physical ownership needs to go through an authenticated channel. You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records.
woodruffw 3y ago
> they are not worse than having no traceability of the package at all between the author and PyPI. Except that they are: PGP does not give you this kind of identity relationship. The most it can give you is an association to a key ID, which is (1) brute-forceable, and (2) not strongly bound to any actual user or machine identity. The only thing worse than an unsecured scheme is an insecure scheme that lulls users into a false sense of security and authenticity. PGP signatures on PyPI are the latter.
- upofadown 3y ago
  >The most it can give you is an association to a key ID, which is (1) brute-forceable This is false. That would mean brute forcing a 160 bit SHA-1 hash. That is not possible.
  - woodruffw 3y ago
    This is wrong on every conceivable level: 1. Key IDs are 32-bit truncations of the SHA-1 hash. That means 32 bits of state, not 160. Fake key IDs are observable in the wild[1]. 2. You're confusing pre-image resistance with collision resistance. SHA-1 has been publicly vulnerable to practical collision attacks since 2017[2]. [1]: https://www.phoronix.com/news/Short-PGP-Collision-Attacks https://www.phoronix.com/news/Short-PGP-Collision-Attacks [2]: https://shattered.io/ https://shattered.io/
    - upofadown 3y ago
      OK, you are talking about the 64 bit keyID. The 32 bit keyIDs are no longer used for the reason you state. Shattered is about SHA-1 use in key signatures. It has nothing to do with keyIDs.
sowbug 3y ago
The system guaranteed that a key signed a package. That was its entire utility. At best, it defeated plausible deniability for package maintainers who had avowed public keys, but then somehow signed a bad package. This wouldn't have stopped the malware from getting onto your system. It only would have led you to the hapless (but honest) package maintainer. It didn't stop someone who is not you from generating a PGP key for Richard WM Jones, signing malware, uploading to PyPi, and then disappearing back under the rock where they live. And if you believe this system is not useless, then you also believe that at least one person out there was not dissuaded from installing that malware because "Hey, someone named Richard WM Jones went through the trouble of signing it!" As is often the case, the value of this system depends on your threat model. I'm not too worried about someone going rogue from the tiny population of people who were using PGP correctly. But I am worried about using a platform that claimed to have signing infrastructure, when that infrastructure had no meaningful checks on who was signing.

speedgoose 3y ago

The article is closer to a blog post than a multiple authors peer reviewed research paper published in a high impact journal.

woodruffw 3y ago
That's because it is a blog post. It isn't advertised as anything else.
- donaldstufft 3y ago
  I wonder if the domain being `blog.pypi.org` tipped them off?

im3w1l 3y ago

I think another thing with pgp is that it's in this awkward place where it's bad enough that few people use it, but good enough that it prevents someone from making an alternative.

akerl_ 3y ago
Nobody's making a PGP alternative because a major part of what makes PGP bad is that it tries to be a generic solution to every problem, when in practice signing and encryption workflows are incredibly domain-specific. People are continuously creating better tools for domains that historically saw PGP usage. To name a few: Signal for short-form messaging, age for file encryption, signify/minisign for artifact signing.