Re:SHA1 collisions make Git vulnerable to attacks
by nebulous1 on Monday February 27, 2017 @08:12AM
(#13743902)
He doesn't mean manually recognising the fingerprint
[ Parent
| on HN ]
Re:SHA1 collisions make Git vulnerable to attacks
by Ajedi32 on Monday February 27, 2017 @10:05AM
(#13744711)
Correct. He's talking about the automated method used on shattered.io to detect files which use the attack. See: https://github.com/cr-marcstevens/sha1collisiondetection
They're basically building that into git so that if this specific collision attack is ever used, git will notice and throw a warning/error.
Re:SHA1 collisions make Git vulnerable to attacks
by strictfp on Monday February 27, 2017 @12:24PM
(#13745889)
Thanks, I misread that. I meant that he says
"But if you use git for source control like in the kernel, the stuff you really care about is source code, which is very much a transparent medium. If somebody inserts random odd generated crud in the middle of your source code, you will absolutely notice. "
, which I think is a very weak argument.