Git files hidden in plain sight
tylercipriani.com
Git files hidden in plain sight
1–10 of 49 posts
Re: Git files hidden in plain sight
#2I know this isn’t about the signing really, but it is my understanding that you sign things with your private key and people can verify that it was you who signed it with the matching public key.
Does this work differently with git?
Re: Git files hidden in plain sight
#3I know this isn’t about the signing really, but it is my understanding that you sign things with your private key and people can verify that it was you who signed it with the matching public key. Does this work differently with git?
This is not a security issue. The key is just hard to update when it expires. Private is private, public is public, even in git.
Re: Git files hidden in plain sight
#4I know this isn’t about the signing really, but it is my understanding that you sign things with your private key and people can verify that it was you who signed it with the matching public key. Does this work differently with git?
Nope, that's how it works with Git.
Re: Git files hidden in plain sight
#5"Hiding" a file as a raw blob with a tag pointing to it, isn't bad if the thing should be able to expire.
If a thing is truly expired, then why have it fill-up the commit graph.
That said, a public key - even an expired one - may have value in keeping around: Verifying older historic releases.
Re: Git files hidden in plain sight
#6"Hiding" a file as a raw blob with a tag pointing to it, isn't bad if the thing should be able to expire. If a thing is truly expired, then why have it fill-up the commit graph. That said, a public key - even an expired one - may have value in keeping around: Verifying older historic releases.
By default, most things assume that tags are immutable and won't check for updates to a tag. So tags aren't great for things that can expire or otherwise need to be changed.
Re: Git files hidden in plain sight
#7I know this isn’t about the signing really, but it is my understanding that you sign things with your private key and people can verify that it was you who signed it with the matching public key. Does this work differently with git?
This is not a security issue. The key is just hard to update when it expires. Private is private, public is public, even in git.
Why does it need to be public? By revealing your public key you also reveal the algo used for your public/private keypair. If you are a renowned developer and have an insecure algo, you might be a victim for targeted attacks
Re: Git files hidden in plain sight
#8[dead]
Re: Git files hidden in plain sight
#9Earlier quoted context omitted.
This is not a security issue. The key is just hard to update when it expires. Private is private, public is public, even in git.
Why does it need to be public? By revealing your public key you also reveal the algo used for your public/private keypair. If you are a renowned developer and have an insecure algo, you might be a victim for targeted attacks
If your goal is to have others verify your signatures, then they need to have your public key.
The solution to using weak algorithms is to not use them, not to hide your public key. If you don’t reveal your public key, then there’s effectively no value in the signatures made by its private half.
Re: Git files hidden in plain sight
#10I know this isn’t about the signing really, but it is my understanding that you sign things with your private key and people can verify that it was you who signed it with the matching public key. Does this work differently with git?
Nope, it’s the same. I believe the blog post is trying to say that including the key in the git object storage is effectively the same thing as self-signing, since there’s no independent key discovery or trust mechanism. In other words: it’s not because it’s a private key, but because putting a public key in the same channel that it’s meant to verify is essentially “useless” from a verification perspective.