PuTTY 0.64 released, fixing a security hole • Hacker News Board

Re: PuTTY 0.64 released, fixing a security hole

#41

Post by yungchin » Wed, Mar 04, 2015, 9:49 AM UTC

leni536 wrote: post #38

286c8cb04bda wrote: post #30

Earlier quoted context omitted.

> Though they provide RSA and DSA signatures how would I verify the signatures themselves? Ideally, it goes something like this -- 1. Start with the master keys. Download them from their website & import them into your keyring. 2. Fetch signatures for those keys from some key servers. (E.g. gpg --recv-keys 6A93B34E). 3. Examine the signatures (E.g. gpg --list-sigs 6A93B34E). Do you trust anybody in that list to have…

> 3. Examine the signatures (E.g. gpg --list-sigs 6A93B34E). Do you trust anybody in that list to have verified the ownership of the keys? Well what if I don't know if I can trust them. Also I couldn't possibly verify them in person so I need to recursively walk through the signing keys to find a trusted signature. Isn't there an easy cli command for this? All I could find are online path finders.

Easy it's not, but since you trust the debian keys already, you could import keys from the debian-keyring - I'm sure there's a path from those to the putty maintainers'. Here's a somewhat detailed description I just found, for how to do such a thing https://tails.boum.org/doc/get/trusting_tails_signing_key/in...

Re: PuTTY 0.64 released, fixing a security hole

#42

Post by chaz72 » Wed, Mar 04, 2015, 10:40 PM UTC

dredmorbius wrote: post #40

chaz72 wrote: post #36

Earlier quoted context omitted.

For those already using PGP, that sounds great. For me, who is not using PGP, my set of trusted keys is currently empty. So it is unverified. Which, arguably, might be safer than being overly trusting of my "trusted CAs", which is verified by a flawed system. I guess I'm still not thrilled wih my options overall, but thank you for your time explaining how to use PGP.

The WoT is both PGP's strength and weakness. Lacking anything else, key security staff for various Linux distributions and key EFF members isn't a bad starting point for this. Assigning those "marginal" trust means that you'd have to have three of those signing a given key to trust it.

Ah, now that is what I was looking for but didn't know how to ask. A few starting points I might trust would go a long way.

Re: PuTTY 0.64 released, fixing a security hole

#43

Post by gruturo » Thu, Mar 05, 2015, 8:56 AM UTC

josteink wrote: post #3

I used to be a huge PuTTY (or derative) user, but recently, I've switched to just using the normal OpenSSH command-line client within Cygwin and ConEmu. While PuTTY is nice, it lacks some features, like proxycommands and stuff which are standard in ~/.ssh/config. Things which can be taken along in a simple & portable fashion. No disrespect to PuTTY, but I just found myself not really needing it anymore.

I do use ProxyCommand in PuTTY - a lot. It's in the Connection -> Proxy options, and it's called "Telnet command, or local proxy command".