Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Git files hidden in plain sight

tylercipriani.com

Post reply on HN
Print view View original

11–20 of 49 posts

Re: Git files hidden in plain sight

#11

Post by woodruffw »

seeknotfind wrote: post #3
mosselman wrote: post #2

I know this isn’t about the signing really, but it is my understanding that you sign things with your private key and people can verify that it was you who signed it with the matching public key. Does this work differently with git?

This is not a security issue. The key is just hard to update when it expires. Private is private, public is public, even in git.

It’s a security issue in the sense that it defeats the signing scheme: rather than negotiating the key out-of-band, the user is trusting the thing they’re trying to verify to supply the key. In other words “trust me because I’m signed, and also trust me to give you the key I’m signed with.”

On the other hand, approximately nobody actually verifies git commit signatures, so it doesn’t matter all that much :-)

Re: Git files hidden in plain sight

#12

Post by lvc_ »

whirlwin wrote: post #7
seeknotfind wrote: post #3

Earlier quoted context omitted.

This is not a security issue. The key is just hard to update when it expires. Private is private, public is public, even in git.

Why does it need to be public? By revealing your public key you also reveal the algo used for your public/private keypair. If you are a renowned developer and have an insecure algo, you might be a victim for targeted attacks

It doesn't necessarily need to be public in the global sense, but it is public in the sense of "you can't rely on keeping it secret as a security boundary". Since its used to validate the signature, it will usually need to be (at least) as public as the signed thing.

Re: Git files hidden in plain sight

#13

Post by whirlwin »

woodruffw wrote: post #9
whirlwin wrote: post #7

Earlier quoted context omitted.

Why does it need to be public? By revealing your public key you also reveal the algo used for your public/private keypair. If you are a renowned developer and have an insecure algo, you might be a victim for targeted attacks

If your goal is to have others verify your signatures, then they need to have your public key. The solution to using weak algorithms is to not use them, not to hide your public key. If you don’t reveal your public key, then there’s effectively no value in the signatures made by its private half.

Isn't the best way to verify the integrity to use git signed commits? GitHub has great support for this

Re: Git files hidden in plain sight

#14

Post by lloeki »

woodruffw wrote: post #9
whirlwin wrote: post #7

Earlier quoted context omitted.

Why does it need to be public? By revealing your public key you also reveal the algo used for your public/private keypair. If you are a renowned developer and have an insecure algo, you might be a victim for targeted attacks

If your goal is to have others verify your signatures, then they need to have your public key. The solution to using weak algorithms is to not use them, not to hide your public key. If you don’t reveal your public key, then there’s effectively no value in the signatures made by its private half.

Fun fact, just as SSH public keys for a user are readily publicly available on GitHub, gpg keys are as well

    curl https://github.com/${username}.keys
    curl https://github.com/${username}.gpg | gpg --list-packets
Interestingly enough, since changing the GH keys is subject to GH authentication (possibly involving 2FA), the owner's key is kind of validated (by GH) so it _kind of_ makes GH a gpg key notary.

Having `git log --show-signatures` validate _all_ signatures is then a matter of:

    curl https://github.com/${username}.gpg | gpg --import
Now I kind of wish GH would sign such user pub keys _at the time they're added_ (thus at the time GH authentication is deemed valid), thus ensuring they've not been tampered with in between.

With a bit of UI GH could present a UI for a user to validate another user's key, and sign that assertion (with a GH private key, not the user's of course) as well.

Of course it hinges on trusting GH, but GH already signs e.g UI borne merge commits on your behalf (via https://github.com/web-flow.gpg) so there's that.

Then next step would be for GH to host an actual key server to accept off-band signed keys containing a magic comment that bind the keys and sigs to GH usernames...

Re: Git files hidden in plain sight

#15

Post by pdpi »

whirlwin wrote: post #7
seeknotfind wrote: post #3

Earlier quoted context omitted.

This is not a security issue. The key is just hard to update when it expires. Private is private, public is public, even in git.

Why does it need to be public? By revealing your public key you also reveal the algo used for your public/private keypair. If you are a renowned developer and have an insecure algo, you might be a victim for targeted attacks

Public key cryptography is pretty pointless if you don’t take advantage of the public part. One, you can’t send me any encrypted messages without my public key. Two, you can’t verify my signatures without my public key.

Insecure algorithms are a red herring here too. Either I know what algo you used and can interact with you, or I don’t.

Re: Git files hidden in plain sight

#18

Post by OJFord »

woodruffw wrote: post #11
seeknotfind wrote: post #3

Earlier quoted context omitted.

This is not a security issue. The key is just hard to update when it expires. Private is private, public is public, even in git.

It’s a security issue in the sense that it defeats the signing scheme: rather than negotiating the key out-of-band, the user is trusting the thing they’re trying to verify to supply the key. In other words “trust me because I’m signed, and also trust me to give you the key I’m signed with.” On the other hand, approximately nobody actually verifies git commit signatures, so it doesn’t matter all that much :-)

I'm not really advocating for it, but GitHub does verify out of band - it uses keys on the profile. (If it says 'unverified', it doesn't match any that are present. If it says neither unverified nor verified, the commit wasn't signed.)

Re: Git files hidden in plain sight

#20

Post by FrostKiwi »

tambourine_man wrote: post #19

But I want to know how they used figlet to generate ANSI colored image. Is that a custom font?

These are standard blocks available in any font. Just search for ANSI or ASCI art image converter and you will find many cli-tools and webapps allowing you to convert images to those ascii blocks.
Post reply on HN