News for hackers. Stuff that matters.

A comment on Docker Hub Hacked – 190k accounts, GitHub tokens revoked, builds disabled. Parent comment

Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by jjeaff on Saturday April 27, 2019 @07:20PM (#19768249)
Integrity is all you need as long as you have verified the original image that you have saved the hash for.
[ Parent | on HN ]
Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by kbirkeland on Sunday April 28, 2019 @02:12PM (#19772663)
Is your argument that you only need integrity if you verified the authenticity out of band?
[ Parent | on HN ]
Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by jjeaff on Tuesday April 30, 2019 @02:06AM (#19785508)
No, I'm saying you only need integrity to validate you are getting the same thing each time. If I checked and made sure an image is safe, then I can save that hash and know that as long as the has matches, I'm always getting that same safe image.
[ Parent | on HN ]
Re:Docker Hub Hacked – 190k accounts, GitHub tokens revoked,... by kbirkeland on Sunday May 05, 2019 @11:55AM (#19833403)
This is useless without authentication though. You're opening yourself up to attacks on the first retrieve. Sure, you can make sure you're getting the file they want you to have, but you don't know _who_ is giving you that file.
[ Parent | on HN ]