Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.project > #8244 > unrolled thread

Repository Link are NOT https://

Back to article view | Back to linux.debian.project

Contents

  Repository Link are NOT https:// tom <public-prv@mailueberfall.de> - 2015-09-03 19:50 +0200
    Re: Repository Link are NOT https:// Nextime <nextime@nexlab.it> - 2015-09-03 20:00 +0200
    Re: Repository Link are NOT https:// Ben Hutchings <ben@decadent.org.uk> - 2015-09-03 20:40 +0200
    Re: Repository Link are NOT https:// Florian Weimer <fw@deneb.enyo.de> - 2015-09-03 22:50 +0200
    Re: Repository Link are NOT https:// Russ Allbery <rra@debian.org> - 2015-09-04 02:10 +0200
      Re: Repository Link are NOT https:// Vincent Bernat <bernat@debian.org> - 2015-09-04 07:30 +0200
        Re: Repository Link are NOT https:// Paul Wise <pabs@debian.org> - 2015-09-04 08:50 +0200

#8244 — Repository Link are NOT https://

Hi,

I have discovered that non of the repository links is https:// . Is it
not safer to use only https:// connections.

And as well the download of a debian distro is only http:// .

Sorry to say that but nearly all other distros used for the downlaod
link https:// . But as repository links they all used only http://
connections like debian.

With regards
Thomas Hasse

[toc] | [next] | [standalone]

#8245

On September 3, 2015 7:05:29 PM CEST, tom <public-prv@mailueberfall.de> wrote:
>Hi,
>
>I have discovered that non of the repository links is https:// . Is it
>not safer to use only https:// connections.
>
>And as well the download of a debian distro is only http:// .
>
>Sorry to say that but nearly all other distros used for the downlaod
>link https:// . But as repository links they all used only http://
>connections like debian.
>
>With regards
>Thomas Hasse

Signong keys for repos and hash check against packages is a valid sobstitute.
-- 
nextime

[toc] | [prev] | [next] | [standalone]

#8246

[Multipart message — attachments visible in raw view] — view raw

On Thu, 2015-09-03 at 19:05 +0200, tom wrote:
> Hi,
> 
> I have discovered that non of the repository links is https:// . Is it
> not safer to use only https:// connections.
> 
> And as well the download of a debian distro is only http:// .
> 
> Sorry to say that but nearly all other distros used for the downlaod
> link https:// . But as repository links they all used only http://
> connections like debian.

It is not necessary to use HTTP-S for authentication of packages:
    http://catless.ncl.ac.uk/Risks/28.58.html#subj13.1

If you need to avoid revealing which packages you are downloading, HTTP
-S doesn't do that because it is still possible to observe the length
of each response.  In that case you should perhaps use Tor:
    http://www.richardhartmann.de/blog/posts/2015/08/25-Tor-enabled_Debian_mirror_part_2/

Ben.

-- 
Ben Hutchings
Everything should be made as simple as possible, but not simpler.
                                                           - Albert Einstein

[toc] | [prev] | [next] | [standalone]

#8247

* tom:

> I have discovered that non of the repository links is https:// . Is it
> not safer to use only https:// connections.

https:// is meaningless for package downloads because anyone can run a
mirror and see the requests directly, even if they are
transport-encrypted with HTTPS.

APT uses GnuPG to verify a signature on the repository, and chains
hashes from there, down to individual .deb files.

[toc] | [prev] | [next] | [standalone]

#8248

tom <public-prv@mailueberfall.de> writes:

> I have discovered that non of the repository links is https:// . Is it
> not safer to use only https:// connections.

> And as well the download of a debian distro is only http:// .

> Sorry to say that but nearly all other distros used for the downlaod
> link https:// . But as repository links they all used only http://
> connections like debian.

It doesn't matter for the integrity of the packages.  APT does a much
stronger validation via a public key signature and doesn't rely on
transport security at all.

It does potentially matter as a source of information leakage, since it
allows others to know what packages you're downloading to your host.
Unfortunately, it's hard for us to deploy a consistent certificate through
our entire mirror network, so it's a bit of a challenge to enable TLS for
package downloads.  It's also not clear that encrypting the package
download channel actually buys you much in terms of privacy, since an
attacker can still do quite a lot by correlating the amount of traffic
with the sizes of packages.

-- 
Russ Allbery (rra@debian.org)               <http://www.eyrie.org/~eagle/>

[toc] | [prev] | [next] | [standalone]

#8249

[Multipart message — attachments visible in raw view] — view raw

 ❦  3 septembre 2015 17:03 -0700, Russ Allbery <rra@debian.org> :

>> I have discovered that non of the repository links is https:// . Is it
>> not safer to use only https:// connections.
>
>> And as well the download of a debian distro is only http:// .
>
>> Sorry to say that but nearly all other distros used for the downlaod
>> link https:// . But as repository links they all used only http://
>> connections like debian.
>
> It doesn't matter for the integrity of the packages.  APT does a much
> stronger validation via a public key signature and doesn't rely on
> transport security at all.

There is still the initial ISO image that would benefit from HTTPS
because the user may not verify the GPG signature. Maybe
cdimage.debian.org could be switched to HTTPS?
-- 
But, for my own part, it was Greek to me.
		-- William Shakespeare, "Julius Caesar"

[toc] | [prev] | [next] | [standalone]

#8250

On Fri, Sep 4, 2015 at 7:20 AM, Vincent Bernat wrote:

> There is still the initial ISO image that would benefit from HTTPS
> because the user may not verify the GPG signature. Maybe
> cdimage.debian.org could be switched to HTTPS?

cdimage.d.o is just a redirector so that isn't going to help unless
there are ISO mirrors that also support https.

If anyone wants to harden Debian installation and infrastructure, here
is your TODO list:

https://wiki.debian.org/Hardening/RepoAndImages

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.project

csiph-web