4 ms·

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package managem

by c22 11y ago

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.

WorldWideWayne 11y ago
Windows does come with tools to establish a verified trust chain...it's just not using ssh. I'm not sure what you mean by authenticated package management, but Windows does authenticate packages that have certificates and you can manage certificates that you trust. What else do you want to do? And I'm fairly certain that Windows comes with even more robust tools out of the box for network trust management than Linux does - at least when it comes to managing networks of Windows machines. I could be wrong. I don't know many people who run office networks full of Linux boxes for comparison and maybe there is really no "out of the box" with Linux...but Windows does have controls baked in for trust and security.
- c22 11y ago
  Fair points. I haven't used Windows since XP so my information is a bit dated but it does look like they've made some progress in this arena. Putty is from a time where most windows software was installed from random .exes on the internet, though. I suspect due to the age of the win32 ecosystem much software still is installed this way in Windows environments.
  - acqq 11y ago
    You're right that a lot of Windows executables and installers are still unsigned. The check of the signature is still something that plain user wouldn't know how to do. The only place where Windows rally enforces the signatures are 64-bit drivers. Another important question is: even if there is a valid signature, how can the user know if the signer of the downloaded file is really the expected author?
fluidcruft 11y ago
certutil -hashfile
Someone1234 11y ago
> This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. It has HTTPS and FTPS support natively. It also supports generating hashes in SHA1, SHA256, SHA384, SHA512, MACTripleDES, MD5, and RIPEMD160 using the aptly named Get-FileHash cmdlet. > no authenticated package management MSI installers can (and should) be signed, and well as many other Windows installers and other binaries. Windows 10 supports "real" package management, but security is unimpacted directly. > Being concerned about privacy and security and running Windows may be mutually incompatible. You've given zero plausible reasons for believing so. All you've demonstrated here is that you know little about Windows and what the term "verified trust chain" means. Just Windows supporting HTTPS alone more or less ruins your point.
pionar 11y ago
Linux doesn't technically come with those either; they're all separate programs that distributions happen to include. Windows has an SSH-like framework for PowerShell[1]. One could argue that Linux doesn't ship with tools for connecting to non-Linux hosts, so why should Windows ship with tools for connecting to Linux hosts? It will have package management in Windows 10 [2]. Powershell can get the hash of a file in many different algorithms. [1] https://technet.microsoft.com/en-us/magazine/ff700227.aspx https://technet.microsoft.com/en-us/magazine/ff700227.aspx [2] https://github.com/OneGet/oneget https://github.com/OneGet/oneget
- c22 11y ago
  > Linux doesn't technically come with those either; they're all separate programs that distributions happen to include. But isn't Windows more like "a distribution of Linux" than "the bare Linux kernel"? When I choose to trust a distribution of Linux (or a BSD or any other complete operating system) I extend that trust to the ecosystem's package manager which usually includes mechanisms for verification. Downloading putty is not a case of trying to connect to a Linux host, though, and SSH is not a linux-only (or even linux originated) protocol. I was just looking at OneGet and it seems like a huge boon to the Windows ecosystem. From my limited research Windows 10 looks pretty nice and is the first version since XP that I may be interested in using.
- toyg 11y ago
  > One could argue that Linux doesn't ship with tools for connecting to non-Linux hosts Except it does, to the extent that vendors make it possible: any repository will have at least one RDP client of sort (probably half-baked, because the protocol is what it is), and Samba is standard fare. Almost any other OS supports SSH, so yeah, Linux in fact does ship with tools to connect to non-Linux hosts, and plenty of them. (Btw, connecting Windows to NFS shares out of the box is much harder than connecting Linux oob to SMB shares...) If there is one thing that would help Microsoft immensely, in their attempts at gaining some traction "in the cloud", is out-of-the-box SSH support. Powershell might be nice but it will never work on anything that is not Windows, so it's fundamentally useless for remote work.
RaleyField 11y ago
Windows 8 ships with a version of Powershell that has builtin Get-FileHash command which can do SHA1, SHA2 (256/384/512), MACTripleDES, MD5 and RIPEMD160.
acqq 11y ago
> no tools to establish any kind of verified trust chain You're wrong, there is a code signature verification built-in in Windows, if the EXE is signed, from the GUI you just have to right click on the file, select "Digital Signatures" and click twice on the signature. Putty however isn't signed. Maybe it would be good to motivate Simon Tatham to start doing this. He should be somehow supported for that. The signature doesn't solve too much (e.g. imagine Putty is signed by Acme Inc -- how do we know that Simon actually worked for Acme Inc at the moment he signed, that is, how do we know we should expect Putty to be signed by Acme Inc, and what if it's signed by Acme LLC, is that the same company etc -- we still need some channels to spread the right information, and when we have them, spreading the right checksums of the binaries would also be enough) but it is probably better than nothing.
MichaelGG 11y ago
What I do is upload my downloads to VirusTotal. That way I can get assurance it's the same file that's been around for a while. Hopefully if it was Trojaned, someone would have reported it. Certainly won't stop a secretly compromised version, but it's a start.
- RaleyField 11y ago
  I do that too, but it's no kind of assurance as any half-competent hacker would test his trojaned versions against various anti-virus software and when it passes all upload it to VirusTotal and similar sites to convince people who rely on such sites. Best thing you can do is to download it from multiple internet connections (via VPN/TOR) and hope that any mitm is closer to your side and not server's side.

by c22 11y ago

WorldWideWayne 11y ago

Windows does come with tools to establish a verified trust chain...it's just not using ssh. I'm not sure what you mean by authenticated package management, but Windows does authenticate packages that have certificates and you can manage certificates that you trust. What else do you want to do? And I'm fairly certain that Windows comes with even more robust tools out of the box for network trust management than Linux does - at least when it comes to managing networks of Windows machines. I could be wrong. I don't know many people who run office networks full of Linux boxes for comparison and maybe there is really no "out of the box" with Linux...but Windows does have controls baked in for trust and security.

c22 11y ago
Fair points. I haven't used Windows since XP so my information is a bit dated but it does look like they've made some progress in this arena. Putty is from a time where most windows software was installed from random .exes on the internet, though. I suspect due to the age of the win32 ecosystem much software still is installed this way in Windows environments.
- acqq 11y ago
  You're right that a lot of Windows executables and installers are still unsigned. The check of the signature is still something that plain user wouldn't know how to do. The only place where Windows rally enforces the signatures are 64-bit drivers. Another important question is: even if there is a valid signature, how can the user know if the signer of the downloaded file is really the expected author?

fluidcruft 11y ago

certutil -hashfile

Someone1234 11y ago

> This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. It has HTTPS and FTPS support natively. It also supports generating hashes in SHA1, SHA256, SHA384, SHA512, MACTripleDES, MD5, and RIPEMD160 using the aptly named Get-FileHash cmdlet. > no authenticated package management MSI installers can (and should) be signed, and well as many other Windows installers and other binaries. Windows 10 supports "real" package management, but security is unimpacted directly. > Being concerned about privacy and security and running Windows may be mutually incompatible. You've given zero plausible reasons for believing so. All you've demonstrated here is that you know little about Windows and what the term "verified trust chain" means. Just Windows supporting HTTPS alone more or less ruins your point.

pionar 11y ago

Linux doesn't technically come with those either; they're all separate programs that distributions happen to include. Windows has an SSH-like framework for PowerShell[1]. One could argue that Linux doesn't ship with tools for connecting to non-Linux hosts, so why should Windows ship with tools for connecting to Linux hosts? It will have package management in Windows 10 [2]. Powershell can get the hash of a file in many different algorithms. [1] https://technet.microsoft.com/en-us/magazine/ff700227.aspx https://technet.microsoft.com/en-us/magazine/ff700227.aspx [2] https://github.com/OneGet/oneget https://github.com/OneGet/oneget

c22 11y ago
> Linux doesn't technically come with those either; they're all separate programs that distributions happen to include. But isn't Windows more like "a distribution of Linux" than "the bare Linux kernel"? When I choose to trust a distribution of Linux (or a BSD or any other complete operating system) I extend that trust to the ecosystem's package manager which usually includes mechanisms for verification. Downloading putty is not a case of trying to connect to a Linux host, though, and SSH is not a linux-only (or even linux originated) protocol. I was just looking at OneGet and it seems like a huge boon to the Windows ecosystem. From my limited research Windows 10 looks pretty nice and is the first version since XP that I may be interested in using.
toyg 11y ago
> One could argue that Linux doesn't ship with tools for connecting to non-Linux hosts Except it does, to the extent that vendors make it possible: any repository will have at least one RDP client of sort (probably half-baked, because the protocol is what it is), and Samba is standard fare. Almost any other OS supports SSH, so yeah, Linux in fact does ship with tools to connect to non-Linux hosts, and plenty of them. (Btw, connecting Windows to NFS shares out of the box is much harder than connecting Linux oob to SMB shares...) If there is one thing that would help Microsoft immensely, in their attempts at gaining some traction "in the cloud", is out-of-the-box SSH support. Powershell might be nice but it will never work on anything that is not Windows, so it's fundamentally useless for remote work.

RaleyField 11y ago

Windows 8 ships with a version of Powershell that has builtin Get-FileHash command which can do SHA1, SHA2 (256/384/512), MACTripleDES, MD5 and RIPEMD160.

acqq 11y ago

> no tools to establish any kind of verified trust chain You're wrong, there is a code signature verification built-in in Windows, if the EXE is signed, from the GUI you just have to right click on the file, select "Digital Signatures" and click twice on the signature. Putty however isn't signed. Maybe it would be good to motivate Simon Tatham to start doing this. He should be somehow supported for that. The signature doesn't solve too much (e.g. imagine Putty is signed by Acme Inc -- how do we know that Simon actually worked for Acme Inc at the moment he signed, that is, how do we know we should expect Putty to be signed by Acme Inc, and what if it's signed by Acme LLC, is that the same company etc -- we still need some channels to spread the right information, and when we have them, spreading the right checksums of the binaries would also be enough) but it is probably better than nothing.

MichaelGG 11y ago

What I do is upload my downloads to VirusTotal. That way I can get assurance it's the same file that's been around for a while. Hopefully if it was Trojaned, someone would have reported it. Certainly won't stop a secretly compromised version, but it's a start.

RaleyField 11y ago
I do that too, but it's no kind of assurance as any half-competent hacker would test his trojaned versions against various anti-virus software and when it passes all upload it to VirusTotal and similar sites to convince people who rely on such sites. Best thing you can do is to download it from multiple internet connections (via VPN/TOR) and hope that any mitm is closer to your side and not server's side.