mainSavannah Administration - Support: sr #109567, Download area link for some...

 
 

sr #109567: Download area link for some packages uses insecure http protocol

Submitter:  Bruno Haible <haible>
Submitted:  Sat 06 Oct 2018 05:58:05 PM UTC
   
 
Category:  Download area - general Priority:  5 - Normal
Severity:  3 - Normal Status:  Postponed
Privacy:  Public Assigned to:  None
Operating System:  GNU/Linux Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Tue 29 Mar 2022 08:34:45 AM UTC, comment #6: 

These days no download protocol can provide any meaningful "security" e.g. because we use basically untrusted mirrors; the only real way to ensure the integrity is checking GPG signatures.

Ineiev <ineiev>
Site Administrator
Sun 07 Oct 2018 10:26:53 AM UTC, comment #5: 


> The other way is to download the .sig file from a trusted place (the master server, not a mirror)


But why the master server is a trusted place? should its CA be trusted?

Ineiev <ineiev>
Site Administrator
Sun 07 Oct 2018 10:08:57 AM UTC, comment #4: 


> the users should make sure that they use the right public keys; but there is no other real way to protect from MITM.


I disagree. Checking the keys is one way to protect from MITM.

The other way is to download the .sig file from a trusted place (the master server, not a mirror) through https, then check whether this signature matches the downloaded binary from the untrusted mirror.

The load of downloading the signatures should be bearable for the master server, since they are not large.

The second way to protect from MITM is easier to implement than the first way. In particular, it has been suggested that the 'wget' program, through an option, could be directed to do the verification. It would be much easier to implement the second way in wget, than the first way.

Bruno Haible <haible>
Sun 07 Oct 2018 09:37:59 AM UTC, comment #3: 


> To enforce security, it would make sense to fetch the .sig file from the main site and only the non-signature files from the mirror.


This doesn't matter: if the signature made with a valid key verifies, the file is authentic (within certain assumptions); else it may not be.

> It requires that users check the signatures.

...

> we all know that there are fake identities floating around...checking more than the usual 8 digits of a key id.


Quite right, the users should make sure that they use the right public keys; but there is no other real way to protect from MITM.

Ineiev <ineiev>
Site Administrator
Sun 07 Oct 2018 12:25:09 AM UTC, comment #2: 


> everyone is free to setup a mirror, and we add them to our list on their request.


Ouch, this is bad. Someone who wants to become MITM for some packages just has to setup a mirror, notify GNU, and add trojan horses to the sources and binaries they offer.

> I think the only real protection is signatures.


Signatures done right would work, yes. But not in the current form:

1) It picks some mirror (in my tests, even the SAME mirror) for a file and its signature file. (I tried https://download.savannah.nongnu.org/releases/acl/acl-2.2.53.tar.gz and https://download.savannah.nongnu.org/releases/acl/acl-2.2.53.tar.gz.sig.)
To enforce security, it would make sense to fetch the .sig file from the main site and only the non-signature files from the mirror.

2) It requires that users check the signatures. Distros are doing  this, but end users often are not - because there is no easy "download + check signature" script available. Some work may be in progress on creating such a script, I don't know.

3) The signatures rely on PGP/GPG, and we all know that there are fake identities floating around in the PGP/GPG servers that are only apparent when checking more than the usual 8 digits of a key id.

Bruno Haible <haible>
Sat 06 Oct 2018 06:24:08 PM UTC, comment #1: 

HTTPS is not really much more secure against MITM attacks: everyone is free to setup a mirror, and we add them to our list on their request.

I think the only real protection is signatures.

Ineiev <ineiev>
Site Administrator
Sat 06 Oct 2018 05:58:05 PM UTC, original submission:  

The project e.g. https://savannah.nongnu.org/projects/acl/ has a link to a "Download area": https://savannah.nongnu.org/files/?group=acl . This is a https URL; good.

But when you enter it in a browser, it redirects to http://download.savannah.nongnu.org/releases/acl/ - which is bad because it encourages users to download via the insecure http protocol, which makes them vulnerable to man-in-the-middle attaks. It would be better to redirect to https://download.savannah.nongnu.org/releases/acl/ instead.

Bruno Haible <haible>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by haible (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2022-03-29 ineiev StatusNone Postponed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code