Re: Travis CI MITM RCE

[vines () riseup net]

> I agree about the "key ID" part, but not about the "fingerprint" part.
> Pinning a cryptographic hash over a public key isn't a security
> antipattern by any strech of the imagination. Sure, you could argue that
> the SHA-1 used by GPG isn't state-of-the-art anymore, but we're not
> talking about collision attacks, but second preimage attacks. Far worse
> for the attacker.

True, yes, harder to brute-force a identical private key, than a key with an identical fingerprint.

However, if someone hadn't considered the possibility of a SHA1 collision attack, and a signature verification fails, 
despite the fingerprint they see matching, what % of GPG users would skip signature verification?
Perhaps due to confusion/self-doubt/inexperience/other.
Admittedly, this could be stepping into the realm of social engineering.