Re: Fwd: Fwd: question regarding verification of a debian installation iso
On Sun, Jan 2, 2011 at 5:24 PM, Naja Melan <najamelan@gmail.com> wrote:
> If we want to seriously speak of security, than we might conceive that at an
> operating system level, amongst many other things, the issue of getting it
> from the developer to the user without it being tampered with on the way is
> quite an important point, less we ridicule ourselves. Currently this is how
> far I get on a practical level on this particular link of the security
> chain:
> 2. Some linux distro's I see now do have certified https, like fedora which
> puts gpg fingerprints (SHA1) of their public keys on their certified
> website.
> 3. Other distros have md5 hashes over certified https, like ubuntu.
> (virtually a shared fourth place with debian)
> 4. debian, which for a general user which has not been able to in a safe way
> obtain a chain of trust to the Debian CD signing key (read: next to
> everyone), it boils down to, well, plain http!
HTTPS is going to make it harder for man-in-the-middle shenanigans,
but that is only part of the path "from the developer to the user."
One also has to consider whether the project's servers have been
tampered with - which tends to be the much more common attack (both
Debian and RedHat / Fedora have experiences with this). HTTPS
("certified" or otherwise) connections to a compromised server means
that you are reasonably sure you're getting data from that compromised
server. It does little to protect you from compromised data. As an
end user, you need some assurance of the integrity of the data you've
downloaded. It really comes down to the signing key. And, more
importantly, knowledge of how to handle and use that key.
If anything, this might be an opportunity for better documentation on
how to do that. One thing I don't like about Fedora's documentation
is blindly getting their signing key from their own server and
trusting that key. It may be a practical compromise between security
and function - especially for the uninitiated. But if I were as
concerned as Naja is about such things, I would be more inclined to
scrutinize that key a bit more to ensure that a bogus key isn't
accompanying a modified ISO on a compromised server. Additional notes
about how to do that (and that such concerns exist) might also be part
of said documentation.
Also - I think this bears repeating since it seems to be overlooked in
the above list. Debian does provide SHA1, SHA256, and SHA512 hashes
as well as MD5 (all signed).
Reply to: