Re: CVE for Kali Linux

[Daniel Micay <danielmicay () gmail com>]

On 22/03/15 01:55 PM, Kurt Seifried wrote:
> So in the case of an ISO download that is GPG signed how do I verify the
> key is correct? If this is all done over HTTP it is pretty trivial for
> an attacker to run a Man in the Middle proxy that string replaces they
> key/signature as needed. HTTPS significantly raises this bar, it goes
> from "run off the shelf Squid/etc" to "convince a CA to give you a wonky
> certificate".

It's not this bad for a notable FOSS project if they're willing to put
in some work. CryptoCat and the Tor project have their keys pinned here
and they're probably in Firefox too (don't feel like checking):

https://code.google.com/p/chromium/codesearch#chromium/src/net/http/transport_security_state_static.json

If major Linux distributions wanted to put in this effort, they'd have
it too. It does mean staying on top of managing certificates, as the pin
needs to be dealt with a few months in advance of switching.

This can't scale which is the main problem with it, but I doubt that
Google or Mozilla would turn away a Linux distribution with a
significant userspace if they wanted to do this. There's little doubt
that they'd pin a key for Debian or Fedora... and it would allow a sane
bootstrap for the distributions GPG keyring.

Attachment: signature.asc
Description: OpenPGP digital signature