Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downloading PuTTY Safely Is Nearly Impossible (2014)

noncombatant.org

Post reply on HN
Print view View original

101–110 of 173 posts

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#101

Post by pdabbadabba »

joshstrange wrote: post #94
pdabbadabba wrote: post #50

Earlier quoted context omitted.

I suspect that if the Putty dev created a Patreon for code signing, and posted it on HN and Reddit, he'd almost immediately have that $73/yr covered for the foreseeable future.

No doubt but we all need to remember that sometimes accepting money is more trouble than it's worth. I know that sounds crazy but people taking donations have to declare that on their taxes and some people don't want to deal with that. Also while crowdfunding platforms have gotten really easy they still take effort and sometimes some sort of verification process. It's obvious the putty dev is not a designer (I don't…

I certainly don't mean to jump down the dev's throat -- I have been using Putty for years (without, I must admit, a second thought about whether the binary might be compromised) with nothing but gratitude. And I don't think anyone else should direct their complaints at the dev either. My comments are addressed to those who complain, in a general way, that it is not easy enough for a developer to write trusted code.

Putty seeks to perform a security-critical function. It may simply not be realistic to expect that someone can simply step into the market and provide such a tool safely, without putting some effort into building trust with users through, e.g., a code signing certificate. That, after all, is one of the reasons why trust works--it is non-trivial to build.

Again, I don't blame a developer for not doing these things, and I am all for helping developers jump through the hoops they need to jump through, if they are willing.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#102

Post by fibo »

Orangeair wrote: post #86

One variant of PuTTY that I use -- PuTTYTray, a portable version of PuTTY with some other features -- is at least delivered over https, although you still have to trust the developer.

Here it is the homepage https://puttytray.goeswhere.com/

you can also try to build it from source https://github.com/FauxFaux/PuTTYTray

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#105

Post by ajmarsh »

hughes wrote: post #4

Putty is pretty awful anyway. Git for windows installs a shell that is not terrible, includes an ssh client, and is distributed over https. It is my go-to when I have to use a windows machine.

Question: Do you mean msysgit, or something else? I almost never use windows but this would be nice for those rare occasions. Thanks in advance.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#106

Post by sliverstorm »

AlyssaRowan wrote: post #66

And to top it off, what size are his PGP signing keys? http://www.chiark.greenend.org.uk/~sgtatham/putty/keys.html 1024-bit RSA, and 1024-bit DSA. Please see my comment earlier today about why that's Very Bad™ in the thread on the "Logjam" attack which shows that 1024-bit keys are too small for safe use now: https://news.ycombinator.com/item?id=9577998 Come on , Simon, I know you know better than that. It really is t…

It seems fairly clear that Simon isn't wildly motivated to stay on top of the ball here, and that's OK. Despite how many people seem to feel, he doesn't owe us anything. He released the software; we can take it, we can not take it.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#107

Post by joshstrange »

pdabbadabba wrote: post #101
joshstrange wrote: post #94

Earlier quoted context omitted.

No doubt but we all need to remember that sometimes accepting money is more trouble than it's worth. I know that sounds crazy but people taking donations have to declare that on their taxes and some people don't want to deal with that. Also while crowdfunding platforms have gotten really easy they still take effort and sometimes some sort of verification process. It's obvious the putty dev is not a designer (I don't…

I certainly don't mean to jump down the dev's throat -- I have been using Putty for years (without, I must admit, a second thought about whether the binary might be compromised) with nothing but gratitude. And I don't think anyone else should direct their complaints at the dev either. My comments are addressed to those who complain, in a general way, that it is not easy enough for a developer to write trusted code. P…

I understand what you are saying about "Putty seeks to perform a security-critical function." and therefore it should take these things into account (in a perfect world). I don't speak for all developers, obviously, but I'd wager a guess that most developers don't code (for OS at least) to "corner the market" or essentially become and run a mini-corporation (Twitter, Blog, Github, HTTPS, Code Signing, Website w/ Landing page, etc). They do it to scratch their own itch or to help someone else scratch theirs. Once they finish they upload it to github or some code-hosting platform as way to share the work they've done and contribute back into the community. TBH we are lucky they do even that. To ask them to provide and maintain extra processes just seems a little wrong. I get that code-signing and HTTPS ARE important and probably needed for a tool like this but I think the question we should be asking is "How can we help get to that point?" and not "Why hasn't the developer done this already?!?!". The fact that the developer continues to update/bug fix this program is amazing (as recently as "2015-02-28") and I worry about driving off a developer/contributor just because they didn't do a few things that probably don't interest them at all.

I say all of that less towards you and more generally in the context of this thread as you did point out "I am all for helping developers jump through the hoops they need to jump through, if they are willing".

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#108

Post by byuu »

kainsavage wrote: post #98
Someone1234 wrote: post #6

None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's En…

TIL: $73/year is "insanely expensive". Literally cheaper than sponsoring an African child or paying Sarah McLachlan to stop using commercials to make me cry.

Would you mind paying for a code signing and two wildcard certificates for me then, please? Yearly, of course.

I would cover the costs out of my profits, but the $0.00/yr I am pulling in from my open source projects doesn't quite cover it, let alone the $200/yr for the VPS and domain registration.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#109

Post by 3am »

Not a PuTTY fan. I generally install Fedora or Linux vms on personal Windows systems (where they are mandatory/heavily advantageous and where security policies permit) in large part to have openssh-client, and then use vmhgfs shares to move files between them as necessary. Among other reasons.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#110

Post by _wldu »

Someone1234 wrote: post #6

None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's En…

"None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not."

You mean Autenticode on Windows? I once had an Authenticode code signing cert that I used to sign Windows executables. Mostly, I signed hobby projects with it.

I wrote a proof of concept keystroke logger for Windows, then Authenticode signed it and made it available along with source code for others to experiment with and review.

Several years later, some customers of Zemena and Comodo complained that the keystroke detection/security software (that they had paid money for) did not detect my keystroke logging software.

This caused a big fuss. Even though my software had been available for years, was code signed, came with full source code and was clearly labeled for educational purposes only, the security companies sent takedown notices to my ISP, placed my domain on DNS blacklists and 'fixed' the issue by declaring any exe signed by my Authenticode cert as malicious. Their customers were then happy and felt safer as it was now 'detected'.

The real issue was that the security software trusted any code that was Authenticode signed and let it run no matter what. There was a check-box somewhere to disable that, but long story short, I would not say that Authenitcode code signing is a big security benefit today. It may help some, but not much. Maybe in the future.

I still have the Keystroke logger source code: https://github.com/w8rbt/keycap

Someone with an Authenticode cert should compile it and then sign it and see if it still gets by the security vendors.

Post reply on HN