Sequoia PGP 1.0 Released: The Seedling Is a Sapling

Re:Sequoia PGP 1.0 Released: The Seedling Is a Sapling by bigiain on Wednesday December 16, 2020 @07:00PM (#25450485)

> I'll tell you what: instead of "don't use PGP," how about "Don't use SHA-1 and don't use any tool that accepts SHA-1 by default."

OK - lets see the implications of this:

> Today, in 2020, that means "don't use ...

Debian.

(As far as I can tell, the known SHA1 attacks have no practical impact on the security of using PGP to sign software updates, where the key management isn't reliant on web of trust... )

[ Parent | on HN ]

Re:Sequoia PGP 1.0 Released: The Seedling Is a Sapling by dfabulich on Wednesday December 16, 2020 @08:12PM (#25451099)

In practice, Debian downloads your packages over HTTPS from reliable trusted parties. HTTPS is the real, actual defense against package manipulation. The PGP signatures do nothing, but they don't really need to work; that's why nobody's bothered to fix them.

[ Parent | on HN ]

Re:Sequoia PGP 1.0 Released: The Seedling Is a Sapling by anderskaseorg on Wednesday December 16, 2020 @08:31PM (#25451221)

No, a default Debian installation downloads packages over plain HTTP. It doesn’t even support downloading packages over HTTPS unless you install the optional apt-transport-https package and edit your sources.list.

It uses SHA-2 checksums since Debian 9, though.

[ Parent | on HN ]

Re:Sequoia PGP 1.0 Released: The Seedling Is a Sapling by pabs3 on Wednesday December 16, 2020 @09:26PM (#25451634)

https cannot protect you from malicious apt mirrors or CDN node operators.

[ Parent | on HN ]