3 ms·
Why put the GPG key on HTTPS page linked from a HTTP page? If the HTTP site is compromised through MITM the attacker can easily change the link to a bucket he c
by relix 13y ago
Why put the GPG key on HTTPS page linked from a HTTP page? If the HTTP site is compromised through MITM the attacker can easily change the link to a bucket he controls, that is also HTTPS (i.e. https://s3.amazonaws.com/secure.jackdb.com/pgp/security_at_jackdb_dot_com.asc https://s3.amazonaws.com/secure.jackdb.com/pgp/security_at_j...).
I don't think it adds anything to security, but actually provides for a fake feeling of safety.
- sehrope 13y agoYou're absolutely right about being able to MITM the HTTP piece and replace the content. That's true for any mixed content site. In this case though I disagree that having the HTTPS link to S3 is entirely useless. It's used specifically for an SSL link to download our GPG key, that additionally is available on a number of key servers and indexed by search engines like that too[1]. In that usage it's one of many ways of getting that key and, like all GPG keys, should really be verified before use anyway. For just about anything else though I agree that mixed content is a very bad idea. [1]: https://www.google.com/search?q=jackdb+gpg https://www.google.com/search?q=jackdb+gpg
- relix 13y agoAlright, I thought I was missing something :)