Re: could we maybe serve checksums TLS on some mirrors? (was Re: concrete steps for improving apt downloading security and privacy)
Yes, I also think it is a pretty shame that we can not download the sha256/512sums from a sever secured by https + DNSSEC/DANE. At least the master mirror cdimage.debian.org needs to provide a secure connection for downloading checksums and the *.jigdo and *.template files. Moreover I would appreciate the jigdo program to work with https + evtl. dnssec as well because http is inherently untrusted and thus insecure. Finally jigdo itself would need to be uploaded to the master mirror as we should not execute any program without inspection from a source which is not secured (would imply that the source is also trusted). If we have https + DNSSEC for lists.debian.org and debian.org why not also for cdimage.debian.org? Elmar Am 10.07.2014 um 18:52 schrieb Joel Rees: When I download a new install image, I pretty much always go to random mirrors, some largish/mainish and some smalish/obscure and download the copies of the checksum files. If all the checksum files compare, I can be pretty confident that one of the following conditions exists: (1) The image is good if the checksum command reports the correct checksum. (2) Some attacker has compromised every mirror I have accessed. (3) Some attacker is doing deep inspections on my traffic and redirecting traffic every time I go looking for a debian mirror. I check a minimum of three mirrors, but when I'm feeling especially paranoid I'll check five or six. It occurs to me that I might cede some usefulness to having the checksums (not images) served TLS transport on at least one of the mirrors, if and only if I remember to set the SSL_CERT_FILE before I fire up lynx to go get the checksums. It won't help me if my randomness in choosing the servers isn't good enough in case (2), but it should help in case (3).
could we maybe serve checksums TLS on some mirrors? (was Re: concrete steps for improving apt downloading security and privacy)
On Thu, Jul 10, 2014 at 9:29 AM, Kitty Cat realizar.la@gmail.com wrote: For years I have been concerned with MITM attacks on Debian mirrors. [...] Hate to trivialize your concerns, but the Debian organization cannot control the mirrors people provide it and remain Debian. You have to remember that when even proposing problems, much less solutions. However, what if http://cdimage.debian.org/ is actually an NSA mirror site and not the real one? [...] When I download a new install image, I pretty much always go to random mirrors, some largish/mainish and some smalish/obscure and download the copies of the checksum files. If all the checksum files compare, I can be pretty confident that one of the following conditions exists: (1) The image is good if the checksum command reports the correct checksum. (2) Some attacker has compromised every mirror I have accessed. (3) Some attacker is doing deep inspections on my traffic and redirecting traffic every time I go looking for a debian mirror. I check a minimum of three mirrors, but when I'm feeling especially paranoid I'll check five or six. It occurs to me that I might cede some usefulness to having the checksums (not images) served TLS transport on at least one of the mirrors, if and only if I remember to set the SSL_CERT_FILE before I fire up lynx to go get the checksums. It won't help me if my randomness in choosing the servers isn't good enough in case (2), but it should help in case (3). -- Joel Rees Computer storage is just fancy paper, and the CPU and I/O are just a fancy pens -- To UNSUBSCRIBE, email to debian-security-requ...@lists.debian.org with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org Archive: https://lists.debian.org/CAAr43iM+6AYc1owhZty+kR55VaXkOP8zd=y7u4vntv0ceco...@mail.gmail.com
