Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.security > #4892 > unrolled thread
| Started by | <aterik1@yahoo.com> |
|---|---|
| First post | 2016-07-12 04:20 +0200 |
| Last post | 2016-07-26 22:00 +0200 |
| Articles | 4 — 4 participants |
Back to article view | Back to linux.debian.security
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
Debian Users Can't Download CD's Integrity/Sign or file-Signing PubKey, Over HTTPS/HKPS Encrypted Connection <aterik1@yahoo.com> - 2016-07-12 04:20 +0200
Re: Debian Users Can't Download CD's Integrity/Sign or file-Signing PubKey, Over HTTPS/HKPS Encrypted Connection Hubert Chathi <uhoreg@debian.org> - 2016-07-12 20:30 +0200
Re: Debian Users Can't Download CD's Integrity/Sign or file-Signing PubKey, Over HTTPS/HKPS Encrypted Connection Weber <kweber33@gmx.de> - 2016-07-26 18:40 +0200
Re: Debian Users Can't Download CD's Integrity/Sign or file-Signing PubKey, Over HTTPS/HKPS Encrypted Connection Neil McGovern <neil@halon.org.uk> - 2016-07-26 22:00 +0200
| From | <aterik1@yahoo.com> |
|---|---|
| Date | 2016-07-12 04:20 +0200 |
| Subject | Debian Users Can't Download CD's Integrity/Sign or file-Signing PubKey, Over HTTPS/HKPS Encrypted Connection |
| Message-ID | <rTVsJ-760-3@gated-at.bofh.it> |
[Multipart message — attachments visible in raw view] — view raw
Hi,
isn't it amazing & SAD that currently DEBIAN USERs CANNOT OBTAIN ANY hash/integrity CODE/file, or signature/sign code/file for CD-DVD ISO file, or the file-signing GPG pubkey file, OVER/THRU a (HTTPS/HKPS) ENCRYPTED connection ? !!! (from the primary domain/server "debian.org" or "www.debian.org" website) ! do you not notice it !!! ? or who forced you to implement+maintain such WEAK security system ?!
in https://www.debian.org/CD/verify webpage: (1a) please Show+Enable HKPS based GPG KeyServer, or (1b) Allow Single GPG PUBKEY File Download (which is including all file-signing pubkeys), Over (HTTPS) ENCRYPTED CONNECTION. And (2) display CD/DVD ISO-file's HASH/CheckSUMS INTEGRITY codes/files (over HTTPS webpage) under that "CD" folder for last+stable debian release, (and also allow HTTPS based sig/sign file, "*.bittorrent" index-file download).
in the https://keyring.debian.org/ webpage also show this, example command-line:
gpg2 —keyserver hkps://keyring.debian.org:443 —recv-keys 0x42468F4009EA8AC3
If above steps are done, then very-large sized (few GIGABYTES sized) ISO-file's can be delivered to users, or users can obtain, over non-encrypted HTTP or FTP etc connection. In fact, all users should be forced to download ISO file over HTTP non-encrypted connection (by using url-redircting in web-server side), WHEN INTEGRITY & PUBKEY is downloadable over (HTTPS/HKPS) ENCRYPTED CONNECTION.
CD/DVD image ISO file's GPG-SIGNATURE (sig/sign) FILE or SHAnnnSUMS INTEGRITY FILES (all of these files are very very TINY SIZED FILES (few KILOBYTES only), compared to the VERY large-sized main file, the ISO files). So AT-LEAST sig/sign file + Sums/Hash code files, need to be shared with all users (from "https://cdimage.debian.org" or https://www.debian.org/CD/ website) over HTTPS encrypted connection/transfer. Currently the "cdimage.debian.org" sub-domain server does not support HTTPS connections & none of the tiny files are downloadable over HTTPS/HKPS ENCRYPTED connection !!! if those tiny files are downlaodable over HTTPS encrypted connection, then users can match/compare, "codes" obtained (over secure HTTPS/HKPS Encrypted connection) from SUMS/hash integrity file, with the calculated hash code of the downloaded ISO file, (or by using a GPG tool, user can verify the authenticity of downloaded ISO file, by using securely downloaded signature file).
since "Debian.org" website is now already DNSSEC signed by it's own developers :) and website's used TLS/SSL cert is also defined+declared in TLSA/DANE dns record :) so all HTTPS webpage INFO from primary website ("https://www.debian.org/") are already (SSL/TLS CA, and, DANE DNSSEC), double channel (aka, double TA) verified. Users can very easily see indication (for free or almost at no-cost) of this double-verification, if they use https://www.dnssec-validator.cz/ addon in (firefox/IE/safari/chrome) web-browser, etc, AND, if a local full dnssec supported dns-resolver, (like "unbound" from https://www.unbound.net/ is used).
please MENTION about these two or similar (DNSSEC-Validator, Unbound) APP, IN THAT "verify" WEBPAGE, so that all users+people can know there are OTHER existing & alternative & trustworthy ways, to verify/authenticate, And "debian.org" website & it's devs have already implemented+using them. Unless you mention about "DNSSEC" in that "verify" webpage, how else would people know about using this alternative ? !!! don't assume every1 is traveling around the world & meeting correct people all the time, & know all kinds of (correct) ways.
please allow your/debian users to enjoy & utilize this double-verification, for getting tiny file-integrity (sums/hash) code files, over HTTPS based encrypted connection from a DNSSEC signed & DANE authenticated website.
Please fix these issues, and update your website. Thank you.
I'm also posting, a similar (not exactly same) request, in Debian-CD Mailing-list, as it requires attention from packagers & devs working on CDs/DVDs, to place & show the integrity-files into primary domain (along with showing in "cdimage" subdomain). Also posting a similar (not exactly same) request in Debian-www Mailing-list, as it requires them to update SSL cert for the "keyring" & "cdimage" subdomain & update the "verify" webpage. Keeping Debian-Security Mailing-list discussion in detail, here, as it involves Debian installer & related file's integrity & Debian webserver's data TRANSFER security.
-- Erik.
[toc] | [next] | [standalone]
| From | Hubert Chathi <uhoreg@debian.org> |
|---|---|
| Date | 2016-07-12 20:30 +0200 |
| Subject | Re: Debian Users Can't Download CD's Integrity/Sign or file-Signing PubKey, Over HTTPS/HKPS Encrypted Connection |
| Message-ID | <rUaBr-bK-15@gated-at.bofh.it> |
| In reply to | #4892 |
On Tue, 12 Jul 2016 02:06:58 +0000 (UTC), <aterik1@yahoo.com> said: > in https://www.debian.org/CD/verify webpage: (1a) please Show+Enable > HKPS based GPG KeyServer, or (1b) Allow Single GPG PUBKEY File > Download (which is including all file-signing pubkeys), Over (HTTPS) > ENCRYPTED CONNECTION. For what purpose? Deliviring the public key over an encrypted connection doesn't help in ensuring the validity of the key when the fingerprint is already delivered over an HTTPS connection. The only thing that it would help is in hiding what key(s) are being requested. [...] > CD/DVD image ISO file's GPG-SIGNATURE (sig/sign) FILE or SHAnnnSUMS > INTEGRITY FILES (all of these files are very very TINY SIZED FILES > (few KILOBYTES only), compared to the VERY large-sized main file, the > ISO files). So AT-LEAST sig/sign file + Sums/Hash code files, need to > be shared with all users (from "https://cdimage.debian.org" or > https://www.debian.org/CD/ website) over HTTPS encrypted > connection/transfer. Again, for what purpose? Delivering the signature files over HTTPS doesn't help in ensuring the validity of the file, since it is validated using GnuPG. -- Hubert Chathi <uhoreg@debian.org> -- Jabber: hubert@uhoreg.ca PGP/GnuPG key: 4096R/113A1368 https://www.uhoreg.ca/ Fingerprint: F24C F749 6C73 DDB8 DCB8 72DE B2DE 88D3 113A 1368
[toc] | [prev] | [next] | [standalone]
| From | Weber <kweber33@gmx.de> |
|---|---|
| Date | 2016-07-26 18:40 +0200 |
| Message-ID | <rZdyG-4lo-17@gated-at.bofh.it> |
| In reply to | #4892 |
https://igurublog.wordpress.com/2014/04/08/julian-assange-debian-is-owned-by-the-nsa/
Am 12.07.2016 um 04:06 schrieb aterik1@yahoo.com:
> Hi,
>
> isn't it amazing & SAD that currently DEBIAN USERs CANNOT OBTAIN ANY hash/integrity CODE/file, or signature/sign code/file for CD-DVD ISO file, or the file-signing GPG pubkey file, OVER/THRU a (HTTPS/HKPS) ENCRYPTED connection ? !!! (from the primary domain/server "debian.org" or "www.debian.org" website) ! do you not notice it !!! ? or who forced you to implement+maintain such WEAK security system ?!
>
> in https://www.debian.org/CD/verify webpage: (1a) please Show+Enable HKPS based GPG KeyServer, or (1b) Allow Single GPG PUBKEY File Download (which is including all file-signing pubkeys), Over (HTTPS) ENCRYPTED CONNECTION. And (2) display CD/DVD ISO-file's HASH/CheckSUMS INTEGRITY codes/files (over HTTPS webpage) under that "CD" folder for last+stable debian release, (and also allow HTTPS based sig/sign file, "*.bittorrent" index-file download).
>
> in the https://keyring.debian.org/ webpage also show this, example command-line:
> gpg2 —keyserver hkps://keyring.debian.org:443 —recv-keys 0x42468F4009EA8AC3
>
> If above steps are done, then very-large sized (few GIGABYTES sized) ISO-file's can be delivered to users, or users can obtain, over non-encrypted HTTP or FTP etc connection. In fact, all users should be forced to download ISO file over HTTP non-encrypted connection (by using url-redircting in web-server side), WHEN INTEGRITY & PUBKEY is downloadable over (HTTPS/HKPS) ENCRYPTED CONNECTION.
>
> CD/DVD image ISO file's GPG-SIGNATURE (sig/sign) FILE or SHAnnnSUMS INTEGRITY FILES (all of these files are very very TINY SIZED FILES (few KILOBYTES only), compared to the VERY large-sized main file, the ISO files). So AT-LEAST sig/sign file + Sums/Hash code files, need to be shared with all users (from "https://cdimage.debian.org" or https://www.debian.org/CD/ website) over HTTPS encrypted connection/transfer. Currently the "cdimage.debian.org" sub-domain server does not support HTTPS connections & none of the tiny files are downloadable over HTTPS/HKPS ENCRYPTED connection !!! if those tiny files are downlaodable over HTTPS encrypted connection, then users can match/compare, "codes" obtained (over secure HTTPS/HKPS Encrypted connection) from SUMS/hash integrity file, with the calculated hash code of the downloaded ISO file, (or by using a GPG tool, user can verify the authenticity of downloaded ISO file, by using securely downloaded signature file).
>
> since "Debian.org" website is now already DNSSEC signed by it's own developers :) and website's used TLS/SSL cert is also defined+declared in TLSA/DANE dns record :) so all HTTPS webpage INFO from primary website ("https://www.debian.org/") are already (SSL/TLS CA, and, DANE DNSSEC), double channel (aka, double TA) verified. Users can very easily see indication (for free or almost at no-cost) of this double-verification, if they use https://www.dnssec-validator.cz/ addon in (firefox/IE/safari/chrome) web-browser, etc, AND, if a local full dnssec supported dns-resolver, (like "unbound" from https://www.unbound.net/ is used).
>
> please MENTION about these two or similar (DNSSEC-Validator, Unbound) APP, IN THAT "verify" WEBPAGE, so that all users+people can know there are OTHER existing & alternative & trustworthy ways, to verify/authenticate, And "debian.org" website & it's devs have already implemented+using them. Unless you mention about "DNSSEC" in that "verify" webpage, how else would people know about using this alternative ? !!! don't assume every1 is traveling around the world & meeting correct people all the time, & know all kinds of (correct) ways.
>
> please allow your/debian users to enjoy & utilize this double-verification, for getting tiny file-integrity (sums/hash) code files, over HTTPS based encrypted connection from a DNSSEC signed & DANE authenticated website.
>
> Please fix these issues, and update your website. Thank you.
>
> I'm also posting, a similar (not exactly same) request, in Debian-CD Mailing-list, as it requires attention from packagers & devs working on CDs/DVDs, to place & show the integrity-files into primary domain (along with showing in "cdimage" subdomain). Also posting a similar (not exactly same) request in Debian-www Mailing-list, as it requires them to update SSL cert for the "keyring" & "cdimage" subdomain & update the "verify" webpage. Keeping Debian-Security Mailing-list discussion in detail, here, as it involves Debian installer & related file's integrity & Debian webserver's data TRANSFER security.
>
> -- Erik.
>
[toc] | [prev] | [next] | [standalone]
| From | Neil McGovern <neil@halon.org.uk> |
|---|---|
| Date | 2016-07-26 22:00 +0200 |
| Message-ID | <rZgGe-6gj-11@gated-at.bofh.it> |
| In reply to | #4923 |
On Tue, Jul 26, 2016 at 06:35:11PM +0200, Weber wrote: > https://igurublog.wordpress.com/2014/04/08/julian-assange-debian-is-owned-by-the-nsa/ > Debunked, many times. https://twitter.com/wikileaks/status/454261872704094208?lang=en-gb Neil
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.security
csiph-web