4 ms·

What would the PGP key be for?

tptacek 14y ago
The Rubygems team (or even just the person who writes the security page) can just generate a new one, for "security@rubygems.org" or whatever, and it can be shared by the team. The purpose of the key is to allow people to report security vulnerabilities without worrying that by doing so they're giving ammunition to people snooping emails.
- willyt 14y ago
  Maybe I dont understand PGP and this is a stupid question, but if the site is compromised, would it not be possible for them to just put a different key up? One which they knew the private key for? How would you know the public key on the compromised site has not been changed unless you could compare it to the PGP key from before the site was compromised?
  - JoachimSchipper 14y ago
    You can't, but having a security.html page gives attackers the possibility to contact you privately and securely; this reduces the chance that they'll decide to "contact" you by completely pwning your public site.
  - tptacek 14y ago
    Publishing the key is what allows you to detect malicious changes to the key.
  - jaytaylor 14y ago
    @JoachimSchipper do sec people inherently know to try hitting /security.html by convention, or should there be links to it from the main site?
    - tptacek 14y ago
      They know to look for a link to the security page. Github's is in their site footer. 37signals' is in their site footer. Twitter's is linked off the sidebar in their "About" page. Google's and Facebook's are the top search result for their site and "vulnerability" "security". These are all fine options.
      - jaytaylor 14y ago
        Thank you!
  - arjie 14y ago
    What if the key is endorsed by the individual people on the team? Their personal keys, which they keep, must sign the security team key. A replacement cannot have this endorsement.
  - rmoriz 14y ago
    You can publish the key on keyservers and get some trust on it. e.g http://pgp.mit.edu:11371/pks/lookup?search=37signals&op=index http://pgp.mit.edu:11371/pks/lookup?search=37signals&op=... http://pgp.mit.edu:11371/pks/lookup?search=heroku http://pgp.mit.edu:11371/pks/lookup?search=heroku
kgo 14y ago
You don't want to send an actual exploit in clear text to a possibly compromised email account. PGP encrypts, and provides some level of validation that the message can only be read by someone on the security team.
jazzyb 14y ago
For encrypting the email with the exploit details. This is quite a common practice in the security industry.
- zobzu 14y ago
  Like signing gems? cough
  - i386 14y ago
    Signing gems should be mandatory
    - zobzu 14y ago
      Don't get me started on python eggs :)

The Rubygems team (or even just the person who writes the security page) can just generate a new one, for "security@rubygems.org" or whatever, and it can be shared by the team. The purpose of the key is to allow people to report security vulnerabilities without worrying that by doing so they're giving ammunition to people snooping emails.

willyt 14y ago
Maybe I dont understand PGP and this is a stupid question, but if the site is compromised, would it not be possible for them to just put a different key up? One which they knew the private key for? How would you know the public key on the compromised site has not been changed unless you could compare it to the PGP key from before the site was compromised?
- JoachimSchipper 14y ago
  You can't, but having a security.html page gives attackers the possibility to contact you privately and securely; this reduces the chance that they'll decide to "contact" you by completely pwning your public site.
- tptacek 14y ago
  Publishing the key is what allows you to detect malicious changes to the key.
- jaytaylor 14y ago
  @JoachimSchipper do sec people inherently know to try hitting /security.html by convention, or should there be links to it from the main site?
  - tptacek 14y ago
    They know to look for a link to the security page. Github's is in their site footer. 37signals' is in their site footer. Twitter's is linked off the sidebar in their "About" page. Google's and Facebook's are the top search result for their site and "vulnerability" "security". These are all fine options.
    - jaytaylor 14y ago
      Thank you!
- arjie 14y ago
  What if the key is endorsed by the individual people on the team? Their personal keys, which they keep, must sign the security team key. A replacement cannot have this endorsement.
- rmoriz 14y ago
  You can publish the key on keyservers and get some trust on it. e.g http://pgp.mit.edu:11371/pks/lookup?search=37signals&op=index http://pgp.mit.edu:11371/pks/lookup?search=37signals&op=... http://pgp.mit.edu:11371/pks/lookup?search=heroku http://pgp.mit.edu:11371/pks/lookup?search=heroku

kgo 14y ago

You don't want to send an actual exploit in clear text to a possibly compromised email account. PGP encrypts, and provides some level of validation that the message can only be read by someone on the security team.

jazzyb 14y ago

For encrypting the email with the exploit details. This is quite a common practice in the security industry.

zobzu 14y ago
Like signing gems? cough
- i386 14y ago
  Signing gems should be mandatory
  - zobzu 14y ago
    Don't get me started on python eggs :)