4 ms·

The issue is not the lack of SSL but to not sign and verify the images. If they want to use mirrors to distribute the binaries it's a far better solution.

by zimbatm 13y ago

StavrosK 13y ago
Yep, even better.
gsnedders 13y ago
You still need to securely fetch the signatures somehow initially. Similarly, http://download.cyanogenmod.org/ http://download.cyanogenmod.org/ provides md5 hashes for downloads but because it's not done over HTTPS you've got no guarantee that you're getting the right hash to verify the insecure download.
- ivanca 13y ago
  Actually if you just google the MD5 and it shows up in google should work as a guarantee (Example: https://www.google.com/search?q=b13afc01102c84425ca995469f1a52cf&rlz=1C1EODB_enCO548CO550&{google:acceptedSuggestion}oq=b13afc01102c84425ca995469f1a52cf&aqs=chrome..69i57.170j0j7&sourceid=chrome&ie=UTF-8&hl=en#hl=en&q=bcc77d179af2c7ce66b17bfd5fad100b&safe=off https://www.google.com/search?q=b13afc01102c84425ca995469f1a...)
  - pferde 13y ago
    Unless the malware is spread by Google.
    - rst 13y ago
      ... or, more likely, the MITM is capable of spoofing selected google searches as well.
      - ivanca 13y ago
        You know Google always uses ssl right?
        rst 13y ago
        There are people in the world capable of spoofing SSL one way or another (forged certs, suborned CAs, etc.), though it certainly does raise the bar past the script kiddie level.
  - erichurkman 13y ago
    Unless the download page is hacked and Google picks up a spoofed checksum. They need to sign their updates as well.
    - ivanca 13y ago
      Yeah, and Linux is compromised if someone kidnaps Linus Torvalds family in exchange for creating a backdoor in the Linux kernel. The security is created by humans to be used by humans; so nothing is truly safe if <insert random circumstance> happens; and anyway, for cases like yours the hack would be found after few days when any of the people in charge of the compiling realizes that the check-sum is spoofed and would advice anyone to update the OS after the issues is taken care of.
- nezza-_- 13y ago
  You just need to have the public-key on the device already and then verify a cryptographic signature (not just a hash) of the zip.
- luizg 13y ago
  Looks like CM have a https version of the download page now.

The issue is not the lack of SSL but to not sign and verify the images. If they want to use mirrors to distribute the binaries it's a far better solution.

by zimbatm 13y ago

The issue is not the lack of SSL but to not sign and verify the images. If they want to use mirrors to distribute the binaries it's a far better solution.

StavrosK 13y ago

Yep, even better.

gsnedders 13y ago

You still need to securely fetch the signatures somehow initially. Similarly, http://download.cyanogenmod.org/ http://download.cyanogenmod.org/ provides md5 hashes for downloads but because it's not done over HTTPS you've got no guarantee that you're getting the right hash to verify the insecure download.

ivanca 13y ago
Actually if you just google the MD5 and it shows up in google should work as a guarantee (Example: https://www.google.com/search?q=b13afc01102c84425ca995469f1a52cf&rlz=1C1EODB_enCO548CO550&{google:acceptedSuggestion}oq=b13afc01102c84425ca995469f1a52cf&aqs=chrome..69i57.170j0j7&sourceid=chrome&ie=UTF-8&hl=en#hl=en&q=bcc77d179af2c7ce66b17bfd5fad100b&safe=off https://www.google.com/search?q=b13afc01102c84425ca995469f1a...)
- pferde 13y ago
  Unless the malware is spread by Google.
  - rst 13y ago
    ... or, more likely, the MITM is capable of spoofing selected google searches as well.
    - ivanca 13y ago
      You know Google always uses ssl right?
      - rst 13y ago
        There are people in the world capable of spoofing SSL one way or another (forged certs, suborned CAs, etc.), though it certainly does raise the bar past the script kiddie level.
- erichurkman 13y ago
  Unless the download page is hacked and Google picks up a spoofed checksum. They need to sign their updates as well.
  - ivanca 13y ago
    Yeah, and Linux is compromised if someone kidnaps Linus Torvalds family in exchange for creating a backdoor in the Linux kernel. The security is created by humans to be used by humans; so nothing is truly safe if <insert random circumstance> happens; and anyway, for cases like yours the hack would be found after few days when any of the people in charge of the compiling realizes that the check-sum is spoofed and would advice anyone to update the OS after the issues is taken care of.
nezza-_- 13y ago
You just need to have the public-key on the device already and then verify a cryptographic signature (not just a hash) of the zip.
luizg 13y ago
Looks like CM have a https version of the download page now.