4 ms·

Kind of off topic: Is there a secure way to download PuTTY? They are hosting on a http page. Though they provide RSA and DSA signatures how would I verify the

by leni536 12y ago

Kind of off topic: Is there a secure way to download PuTTY? They are hosting on a http page. Though they provide RSA and DSA signatures how would I verify the signatures themselves? I'm kind of new to walking through trust paths. I don't even have any entry point too since nobody I know use public key encryption (I trust the Debian keys already though since I use their distro, maybe I can use that for a starting point?). My best bet would be to download the signatures and keys from different mirrors and sources to limit the possibility of a successful targeted MITM attack.

easytiger 12y ago
How does that make it more secure? HTTPS doesn't do anything to stop an attacker accessing the host and changing the contents. If you are concerned by MITMA then download from multiple nations and compare or download the source and build it yourself
- nodata 12y ago
  Downloading a file from multiple nations and comparing is more work that downloading it over HTTPS.
- leni536 12y ago
  An attacker can't change the content without breaking the signatures and keys. If you can verify the keys from independent sources you can feel safe (this is where I don't have practice). If an attacker somehow can steal the private keys it's bad, but compromising the web page doesn't mean that they have access to the private keys used for the signatures. I don't know about common security practices for managing https keys but I would think that a compromised https server would mean a compromised ssl private key too in most cases. Also https only verifies that page you see is the one intended to be hosted by the URL's owner. Even if the website had a valid cert signed by a trustworthy CA it wouldn't mean more. From that URL I couldn't tell if it's still a trustworthy site from I can download PuTTY. I don't know the state of PGP though. I'm looking at http://keyserver.ubuntu.com/ http://keyserver.ubuntu.com/ right now and all I see are plain signatures of keys without any comment on the "type of trust" between the two parties (I'm really new to this). But it seems probable that if somebody signed the PuTTY master keys then it meant that "I trust that this key belongs to the PuTTY team who create the trustworthy PuTTY software" since I wouldn't sign faulty software even if I knew that it came from a valid source. It would be nice if people would sign certificates with comments like this. edit: Sorry, seems like I misunderstood your comment. For my defense you misunderstood mine too. I don't say HTTPS is more secure. I just don't have any practice in verifying keys using gnupg. edit2: download the source and build it yourself I usually don't audit the source code I build from a random project. A compromised source code for me is as dangerous as a compromised binary (for me at least).
akavel 12y ago
According to: https://news.ycombinator.com/item?id=7334269 https://news.ycombinator.com/item?id=7334269 - doesn't look like it's currently possible...
286c8cb04bda 12y ago
> Though they provide RSA and DSA signatures how would I verify the signatures themselves? Ideally, it goes something like this -- 1. Start with the master keys. Download them from their website & import them into your keyring. 2. Fetch signatures for those keys from some key servers. (E.g. gpg --recv-keys 6A93B34E). 3. Examine the signatures (E.g. gpg --list-sigs 6A93B34E). Do you trust anybody in that list to have verified the ownership of the keys? If "yes", then import the release keys and verify that _they_ have been signed by the master keys. You can use the release keys to verify the downloaded binary. If "no", then you might recurse down those keys to see if you know anyone who signed any of _them_. At this point, you'll need to consider very carefully what your trust policy is going to be.
- deleted 12y ago
  [deleted]
- leni536 12y ago
  > 3. Examine the signatures (E.g. gpg --list-sigs 6A93B34E). Do you trust anybody in that list to have verified the ownership of the keys? Well what if I don't know if I can trust them. Also I couldn't possibly verify them in person so I need to recursively walk through the signing keys to find a trusted signature. Isn't there an easy cli command for this? All I could find are online path finders.
  - yungchin 12y ago
    Easy it's not, but since you trust the debian keys already, you could import keys from the debian-keyring - I'm sure there's a path from those to the putty maintainers'. Here's a somewhat detailed description I just found, for how to do such a thing https://tails.boum.org/doc/get/trusting_tails_signing_key/index.en.html#index3h1 https://tails.boum.org/doc/get/trusting_tails_signing_key/in...

by leni536 12y ago

easytiger 12y ago

How does that make it more secure? HTTPS doesn't do anything to stop an attacker accessing the host and changing the contents. If you are concerned by MITMA then download from multiple nations and compare or download the source and build it yourself

nodata 12y ago
Downloading a file from multiple nations and comparing is more work that downloading it over HTTPS.
leni536 12y ago
An attacker can't change the content without breaking the signatures and keys. If you can verify the keys from independent sources you can feel safe (this is where I don't have practice). If an attacker somehow can steal the private keys it's bad, but compromising the web page doesn't mean that they have access to the private keys used for the signatures. I don't know about common security practices for managing https keys but I would think that a compromised https server would mean a compromised ssl private key too in most cases. Also https only verifies that page you see is the one intended to be hosted by the URL's owner. Even if the website had a valid cert signed by a trustworthy CA it wouldn't mean more. From that URL I couldn't tell if it's still a trustworthy site from I can download PuTTY. I don't know the state of PGP though. I'm looking at http://keyserver.ubuntu.com/ http://keyserver.ubuntu.com/ right now and all I see are plain signatures of keys without any comment on the "type of trust" between the two parties (I'm really new to this). But it seems probable that if somebody signed the PuTTY master keys then it meant that "I trust that this key belongs to the PuTTY team who create the trustworthy PuTTY software" since I wouldn't sign faulty software even if I knew that it came from a valid source. It would be nice if people would sign certificates with comments like this. edit: Sorry, seems like I misunderstood your comment. For my defense you misunderstood mine too. I don't say HTTPS is more secure. I just don't have any practice in verifying keys using gnupg. edit2: download the source and build it yourself I usually don't audit the source code I build from a random project. A compromised source code for me is as dangerous as a compromised binary (for me at least).

akavel 12y ago

According to: https://news.ycombinator.com/item?id=7334269 https://news.ycombinator.com/item?id=7334269 - doesn't look like it's currently possible...

286c8cb04bda 12y ago

> Though they provide RSA and DSA signatures how would I verify the signatures themselves? Ideally, it goes something like this -- 1. Start with the master keys. Download them from their website & import them into your keyring. 2. Fetch signatures for those keys from some key servers. (E.g. gpg --recv-keys 6A93B34E). 3. Examine the signatures (E.g. gpg --list-sigs 6A93B34E). Do you trust anybody in that list to have verified the ownership of the keys? If "yes", then import the release keys and verify that _they_ have been signed by the master keys. You can use the release keys to verify the downloaded binary. If "no", then you might recurse down those keys to see if you know anyone who signed any of _them_. At this point, you'll need to consider very carefully what your trust policy is going to be.

deleted 12y ago
[deleted]
leni536 12y ago
> 3. Examine the signatures (E.g. gpg --list-sigs 6A93B34E). Do you trust anybody in that list to have verified the ownership of the keys? Well what if I don't know if I can trust them. Also I couldn't possibly verify them in person so I need to recursively walk through the signing keys to find a trusted signature. Isn't there an easy cli command for this? All I could find are online path finders.
- yungchin 12y ago
  Easy it's not, but since you trust the debian keys already, you could import keys from the debian-keyring - I'm sure there's a path from those to the putty maintainers'. Here's a somewhat detailed description I just found, for how to do such a thing https://tails.boum.org/doc/get/trusting_tails_signing_key/index.en.html#index3h1 https://tails.boum.org/doc/get/trusting_tails_signing_key/in...