PuTTY 0.64 released, fixing a security hole
chiark.greenend.org.uk
PuTTY 0.64 released, fixing a security hole
1–10 of 43 posts
Re: PuTTY 0.64 released, fixing a security hole
#2Another security hole of PuTTY is downloads being served over non-SSL.
I should know better and check the sigs using PGP and checksums, but on Windows this is such a drag that I just end up whispering hallelujah praise the Lord, and hoping for the best.
I know it's my fault, but I'd still like SSL :(
Re: PuTTY 0.64 released, fixing a security hole
#3I used to be a huge PuTTY (or derative) user, but recently, I've switched to just using the normal OpenSSH command-line client within Cygwin and ConEmu.
While PuTTY is nice, it lacks some features, like proxycommands and stuff which are standard in ~/.ssh/config. Things which can be taken along in a simple & portable fashion.
No disrespect to PuTTY, but I just found myself not really needing it anymore.
Re: PuTTY 0.64 released, fixing a security hole
#4Kind of off topic:
Is there a secure way to download PuTTY? They are hosting on a http page. Though they provide RSA and DSA signatures how would I verify the signatures themselves? I'm kind of new to walking through trust paths. I don't even have any entry point too since nobody I know use public key encryption (I trust the Debian keys already though since I use their distro, maybe I can use that for a starting point?).
My best bet would be to download the signatures and keys from different mirrors and sources to limit the possibility of a successful targeted MITM attack.
Re: PuTTY 0.64 released, fixing a security hole
#5Kind of off topic: Is there a secure way to download PuTTY? They are hosting on a http page. Though they provide RSA and DSA signatures how would I verify the signatures themselves? I'm kind of new to walking through trust paths. I don't even have any entry point too since nobody I know use public key encryption (I trust the Debian keys already though since I use their distro, maybe I can use that for a starting poin…
How does that make it more secure? HTTPS doesn't do anything to stop an attacker accessing the host and changing the contents. If you are concerned by MITMA then download from multiple nations and compare or download the source and build it yourself
Re: PuTTY 0.64 released, fixing a security hole
#6Kind of off topic: Is there a secure way to download PuTTY? They are hosting on a http page. Though they provide RSA and DSA signatures how would I verify the signatures themselves? I'm kind of new to walking through trust paths. I don't even have any entry point too since nobody I know use public key encryption (I trust the Debian keys already though since I use their distro, maybe I can use that for a starting poin…
How does that make it more secure? HTTPS doesn't do anything to stop an attacker accessing the host and changing the contents. If you are concerned by MITMA then download from multiple nations and compare or download the source and build it yourself
Downloading a file from multiple nations and comparing is more work that downloading it over HTTPS.
Re: PuTTY 0.64 released, fixing a security hole
#7It would have been better if the 0.64 release had been pulled, the fixed 0.64 release should have been named 0.65.
Re: PuTTY 0.64 released, fixing a security hole
#8Another security hole of PuTTY is downloads being served over non-SSL. I should know better and check the sigs using PGP and checksums, but on Windows this is such a drag that I just end up whispering hallelujah praise the Lord, and hoping for the best. I know it's my fault, but I'd still like SSL :(
> I should know better and check the sigs using PGP and checksums
Kind of pointless. If the download has been compromised so have the checksums
Re: PuTTY 0.64 released, fixing a security hole
#9Another security hole of PuTTY is downloads being served over non-SSL. I should know better and check the sigs using PGP and checksums, but on Windows this is such a drag that I just end up whispering hallelujah praise the Lord, and hoping for the best. I know it's my fault, but I'd still like SSL :(
> but on Windows this is such a drag that
Get the keybase.io client, it sets up your GPG pretty nicely. I was able to confirm the downloads on Windows using the standard ``gpg --verify putty.DSA.asc`` and it just worked(tm) in a cmd.exe window. Using the keybase client does not, however, as the signing key for the putty binaries is not on keybase.
Not saying anything about how much sense it makes to verify the downloads, just saying that it does work well on Windows, without any cygwin, mingw or whatever.
Re: PuTTY 0.64 released, fixing a security hole
#10Kind of off topic: Is there a secure way to download PuTTY? They are hosting on a http page. Though they provide RSA and DSA signatures how would I verify the signatures themselves? I'm kind of new to walking through trust paths. I don't even have any entry point too since nobody I know use public key encryption (I trust the Debian keys already though since I use their distro, maybe I can use that for a starting poin…
How does that make it more secure? HTTPS doesn't do anything to stop an attacker accessing the host and changing the contents. If you are concerned by MITMA then download from multiple nations and compare or download the source and build it yourself
An attacker can't change the content without breaking the signatures and keys. If you can verify the keys from independent sources you can feel safe (this is where I don't have practice). If an attacker somehow can steal the private keys it's bad, but compromising the web page doesn't mean that they have access to the private keys used for the signatures. I don't know about common security practices for managing https keys but I would think that a compromised https server would mean a compromised ssl private key too in most cases.
Also https only verifies that page you see is the one intended to be hosted by the URL's owner. Even if the website had a valid cert signed by a trustworthy CA it wouldn't mean more. From that URL I couldn't tell if it's still a trustworthy site from I can download PuTTY.
I don't know the state of PGP though. I'm looking at http://keyserver.ubuntu.com/ right now and all I see are plain signatures of keys without any comment on the "type of trust" between the two parties (I'm really new to this). But it seems probable that if somebody signed the PuTTY master keys then it meant that "I trust that this key belongs to the PuTTY team who create the trustworthy PuTTY software" since I wouldn't sign faulty software even if I knew that it came from a valid source. It would be nice if people would sign certificates with comments like this.
edit: Sorry, seems like I misunderstood your comment. For my defense you misunderstood mine too. I don't say HTTPS is more secure. I just don't have any practice in verifying keys using gnupg.
edit2:
download the source and build it yourself
I usually don't audit the source code I build from a random project. A compromised source code for me is as dangerous as a compromised binary (for me at least).