4 ms·
I wonder something every time I download Mullvad’s updated VPN client. ‘Verify this download with the GPG signature’, it tells me. But surely if I’m in a posit
by jen729w 3y ago
I wonder something every time I download Mullvad’s updated VPN client. ‘Verify this download with the GPG signature’, it tells me.
But surely if I’m in a position where I’ve poisoned Mullvad’s executable, I’m also in a position where I’ve doctored the GPG sig to match? That sig just being something that I download from mullvad.net.
Unless it’s somehow independently verified, I’m not sure that I see the point?
(Or anything else similar. Not picking on Mullvad, it’s just the one that comes to mind.)
- uxp8u61q 3y agoIdeally, you'd have downloaded the GPG key on first use and check newer updates against that. It's a version of "Trust on First Use". It doesn't protect you against attacks during the initial installation, but it protects you against fake updates.
- throwaway64643 3y agoYou've gotta check if they published their GPG signature somewhere else before, either in their social media pages, internet web cache, or forum.