If you get the signature from the same place you found the download link (or a place that may be controlled by the same entity), that seems precisely as good as HTTPS.
You are thinking of hashes. Look up cryptographic signatures.
Re:The sad state of Linux download security
by sdegutis on Sunday July 17, 2016 @12:50PM
(#12110758)
... as long as you know the signature offered is correct and wasn't also hijacked.
Re:The sad state of Linux download security
by falcolas on Sunday July 17, 2016 @12:52PM
(#12110771)
So long as the secret key was not compromised, then the signature file also just doesn't matter - if it's compromised, the validation fails. One of the beauties of asymmetric encryption, making GPG worth learning about.
I think this really only applies for signatures you can trust. A frightening number of keys used to sign software are not signed by anyone, so they're effectively the equivalent of a self signed certificate.
I've also found some projects where the key used to sign the software isn't even consistent between releases, so you don't even have the (minimal) protection offered by checking the signatures against "known good" builds.
Re:The sad state of Linux download security
by RaleyField on Sunday July 17, 2016 @04:51PM
(#12111758)
> A frightening number of keys used to sign software are not signed by anyone, so they're effectively the equivalent of a self signed certificate.
I wonder how hard would it be to socially engineer yourself into trust chain. I haven't read GPG manuals, but I'd be surprised if there were strict protocols followed by everyone when signing others' keys. Most people probably don't or can't insure that there is no mitm when signing keys and can't reliably verify that government id papers aren't forgeries so likely reliable chains of trusts exists only between people that spend large quantities of time together and exchange fingerprints over secure channel.
I'd be happy to be corrected, but I think this applied to the Fedora keys?
You also have to know that the public key you have is the one that corresponds to the secret key that they have.
Re:The sad state of Linux download security
by RaleyField on Sunday July 17, 2016 @04:37PM
(#12111703)
Ubuntu isos are signed by the same key that's present in the installation, so if you have older version laying around you can verify against that.
HTTPS can be MITMed by anybody with a root certificate (or who is able to dupe the holder of a root certificate). Signatures rely on (at best) multiple hosts or domains not being compromised. You can also mirror and cache distro ISOs when retrieved by HTTP or bittorrent.
In the end, who cares how you downloaded it, so long as you can verify it with a GPG signature?