could we maybe serve checksums TLS on some mirrors? (was Re: concrete steps for improving apt downloading security and privacy)
On Thu, Jul 10, 2014 at 9:29 AM, Kitty Cat <realizar.la.paz@gmail.com> wrote:
> For years I have been concerned with MITM attacks on Debian mirrors.
>
> [...]
Hate to trivialize your concerns, but the Debian organization cannot
control the mirrors people provide it and remain Debian.
You have to remember that when even proposing problems, much less solutions.
> However, what if http://cdimage.debian.org/ is actually an NSA mirror site and not the real one?
> [...]
When I download a new install image, I pretty much always go to random
mirrors, some largish/mainish and some smalish/obscure and download
the copies of the checksum files. If all the checksum files compare, I
can be pretty confident that one of the following conditions exists:
(1) The image is good if the checksum command reports the correct checksum.
(2) Some attacker has compromised every mirror I have accessed.
(3) Some attacker is doing deep inspections on my traffic and
redirecting traffic every time I go looking for a debian mirror.
I check a minimum of three mirrors, but when I'm feeling especially
paranoid I'll check five or six.
It occurs to me that I might cede some usefulness to having the
checksums (not images) served TLS transport on at least one of the
mirrors, if and only if I remember to set the SSL_CERT_FILE before I
fire up lynx to go get the checksums. It won't help me if my
randomness in choosing the servers isn't good enough in case (2), but
it should help in case (3).
--
Joel Rees
Computer storage is just fancy paper,
and the CPU and I/O are just a fancy pens
Reply to: