Re: HTTPS enabled Debian Security repository

From	Hans-Christoph Steiner <hans@at.or.at>
Newsgroups	linux.debian.security
Subject	Re: HTTPS enabled Debian Security repository
Date	2017-10-27 12:50 +0200
Message-ID	<uFan8-2n7-3@gated-at.bofh.it> (permalink)
References	<uEM1s-3cc-5@gated-at.bofh.it> <uEM1s-3cc-9@gated-at.bofh.it> <uEV4K-l1-3@gated-at.bofh.it>
Organization	@\|\|@

Show all headers | View raw


Christoph Biedl:
> 林博仁 wrote...
> 
>> I believe that there's no benefit on accessing Debian archive with HTTPS as
>> they uses GnuPG for authentication
> 
> GnuPG indeed serves the purposes of authenticity and integrity very
> well. Modulo bugs every now and then, but they happen on other layers as
> well.
> 
> Also, nobody should rely on the privacy in this case since the server
> content is public and the clients have a fairly simple access pattern.
> Decoding the transfers from this isn't trival but seems doable with some
> effort - one day I'll write a prove of concept for this.
> 
> There is however a reason for https, a sad one though: Braindead
> "security" applicances that do deep packet inspection and might reject
> the download of packages.
> 
>     Christoph
> 

This idea that GPG signatures on the index files is enough has been
totally disproven.  There was a bug in apt where Debian devices could be
exploited by feeding them crafted InRelease files:

https://www.debian.org/security/2016/dsa-3733

If HTTPS was used, that would mean exploiting that would require
compromising the mirror servers.  With HTTP only, anyone that can see
the network traffic can exploit the Debian box.  Plus there are other
things that using HTTPS improves:

https://guardianproject.info/2014/10/16/reducing-metadata-leakage-from-software-updates/

HTTPS does not entirely solve all these problems, but it does
drastically improve things.

.hc

Thread

HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-10-26 10:50 +0200
  Re: HTTPS enabled Debian Security repository 林博仁 <buo.ren.lin@gmail.com> - 2017-10-26 10:50 +0200
    Re: HTTPS enabled Debian Security repository Christoph Biedl <debian.axhn@manchmal.in-ulm.de> - 2017-10-26 20:30 +0200
      Re: HTTPS enabled Debian Security repository Hans-Christoph Steiner <hans@at.or.at> - 2017-10-27 12:50 +0200
        Re: HTTPS enabled Debian Security repository Morris Taylor <morris@eml.cc> - 2017-10-27 16:00 +0200
          Re: HTTPS enabled Debian Security repository Luca Filipozzi <lfilipoz@debian.org> - 2017-10-27 16:30 +0200
        Re: HTTPS enabled Debian Security repository Henrique de Moraes Holschuh <hmh@debian.org> - 2017-10-28 05:00 +0200
          Re: HTTPS enabled Debian Security repository Ansgar Burchardt <ansgar@debian.org> - 2017-10-28 10:30 +0200
            Re: HTTPS enabled Debian Security repository Hans-Christoph Steiner <hans@at.or.at> - 2017-10-30 10:10 +0100
              Re: HTTPS enabled Debian Security repository Russell Coker <russell@coker.com.au> - 2017-10-30 12:40 +0100
                Re: HTTPS enabled Debian Security repository Rob van der Putten <rob@sput.nl> - 2017-10-31 00:40 +0100
      Re: HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-11-09 11:00 +0100
        Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-11-09 11:20 +0100
          Re: HTTPS enabled Debian Security repository Marek Sebera <marek.sebera@gmail.com> - 2017-11-09 11:40 +0100
            Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-11-09 12:00 +0100
  Re: HTTPS enabled Debian Security repository Paul Wise <pabs@debian.org> - 2017-10-26 11:00 +0200
  Re: HTTPS enabled Debian Security repository Tototechy <angelmarckus@rediffmail.com> - 2020-01-16 17:00 +0100

csiph-web