Re: Proposal: Trust feeds served via HTTPS without GPG signature

On 15 May 2018 at 20:58, Miess, Philip (TR Technology & Ops)
<[email protected]> wrote:
> Bastian,
>         Generally, this means that any CA, or government controlling one, could potentially sign any package.
> That's a pretty big attack surface. Its already failed at least twice when Comodo and DigiNotar where compromised.
> One mitigation for that problem is certificate pinning. Chrome, Firefox and Opera implemented that but now Chrome is going to pull it out in Chrome 67.
> https://www.zdnet.com/article/google-chrome-is-backing-away-from-public-key-pinning-and-heres-why/
> Also this means that only systems with up to date certificates can install these packages.
>
> I've found getting the dependencies correct, and manually creating commands and entry points to take much more effort than signing the packages.
> On Windows if you have Putty Pageant, you only have to enter your key password once and then signing is as easy as saving the file.
>
> Phil
>
> -----Original Message-----
> From: Bastian Eicher [mailto:[email protected]]
> Sent: Tuesday, May 15, 2018 1:43 PM
> To: ''The Zero Install system'' <[email protected]>
> Subject: [Zero-install-devel] Proposal: Trust feeds served via HTTPS without GPG signature
>
> Hello all,
>
> creating Zero Install feeds is pretty straight-forward for new users, thanks to Thomas' great documentation. Especially the fact that hosting feeds only requires an HTTP server serving static files makes the entry barrier very low. However, the step of signing feeds with GPG signatures adds a slight hurdle. Rather than simply editing XML files with whatever method they chose, publishers must always include tools like 0publish or 0repo in their workflow. While these are fairly easy to get up and running it still lacks the simplicity of "just write a file and upload it".

That's true. However, 0repo can perform other useful checks on the
feeds too, so it's probably worth getting people to use it anyway.

> There seems to be a trend for modern package-manager-like systems to rely on HTTPS for verifying the identity and integrity of a package. Docker images pulled from registries are a great example of this. This meshes well with the wide-spread adoption of Let's Encrypt that make TLS certificates just as accessible as GPG keypairs.

Note that Docker is trying to get people to sign their packages with
Notary (https://docs.docker.com/notary/getting_started/), rather than
rely on just https.

The other https one I'm familiar with is OCaml's opam repository,
which is trying to move to signing with Conex
(https://hannes.nqsb.io/Posts/Conex).

https is useful to prevent replay attacks (where someone pretends to
be the server and serves a once-correct but now out-of-date version,
presumably with some known security flaw), but it has a lot of
limitations:

- The private key must be on the server and available for use at all
times, which makes it an easy target. It's much easier to secure your
GPG key on your own machine.

- You can prove that a server served up a bad feed after the fact, by
showing someone some malicious feed with a valid signature from some
key. https doesn't leave any trace afterwards.

- As Phil notes above, https certificates are rather easy get. Any
authority can issue certificates for any site. Also, if you can
intercept either DNS or plain http connections for a few seconds, you
can get an https certificate.

- The mirror server preserves GPG signatures, so that it can only do
replay attacks, but not change the feeds in other ways.

So I'm not very keen on allowing this.

> I would therefore like to propose a new "feature" for Zero Install: Trust any feed downloaded from an HTTPS URL even if it does not have a GPG signature.
>
> What do you guys think about this? Would it help with adoption? Would we be opening up potential security problems?
>
> Regards
> Bastian


-- 
talex5 (GitHub/Twitter)        http://roscidus.com/blog/
GPG: 5DD5 8D70 899C 454A 966D  6A51 7513 3C8F 94F6 E0CC

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot