Re: secure downloading of patches (Re: Knocking Microsoft)

[Martin Mačok <martin.macok () underground cz>]

On Sun, Feb 29, 2004 at 02:38:08PM +0100, Cedric Blancher wrote:

> > The main issue here is authentication and integrity -- you can
> > achieve both with proper use of either SSL or PGP.
>
> Good point. SSL can provide a proper identification for download
> site. However, this is not sufficient as legitimate site can get
> compromised and its date archive trojaned, as it's been the case
> with OpenSSH two years ago.

You are true that PGP is a stronger protection from this point of view
but keep in mind that neither SSL nor PGP can protect us in the case
of the compromised end point -- the server or developper's workstation
in the case of SSL/TLS and the developper's workstation in the case of
PGP.

> From the other point of view, only SSL/TLS can protect you against the
attacks on the transfer itself. For example, the attacker can poison
your DNS cache and trick you into connecting to the site that does not
provide the patch (so you stay vulnerable).

Martin Mačok

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html