If you are really concerned about security, why would you trust an prebuilt binary of an open source project. The source is available, just grab the source and build it your self. That way you at least know what you have.
Downloading PuTTY Safely Is Nearly Impossible (2014)
111–120 of 173 posts
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#112Earlier quoted context omitted.
Windows does come with tools to establish a verified trust chain...it's just not using ssh. I'm not sure what you mean by authenticated package management, but Windows does authenticate packages that have certificates and you can manage certificates that you trust. What else do you want to do? And I'm fairly certain that Windows comes with even more robust tools out of the box for network trust management than Linux…
Fair points. I haven't used Windows since XP so my information is a bit dated but it does look like they've made some progress in this arena. Putty is from a time where most windows software was installed from random .exes on the internet, though. I suspect due to the age of the win32 ecosystem much software still is installed this way in Windows environments.
You're right that a lot of Windows executables and installers are still unsigned. The check of the signature is still something that plain user wouldn't know how to do. The only place where Windows rally enforces the signatures are 64-bit drivers.
Another important question is: even if there is a valid signature, how can the user know if the signer of the downloaded file is really the expected author?
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#113This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.
What I do is upload my downloads to VirusTotal. That way I can get assurance it's the same file that's been around for a while. Hopefully if it was Trojaned, someone would have reported it. Certainly won't stop a secretly compromised version, but it's a start.
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#114Earlier quoted context omitted.
How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…
The home page is clearly organized and readable, only having some text and links. What more do you want from a website that only exists to distribute one program? There's a link to the download page right on top. It's more than good enough. Do you need flashy CSS animations and a Konami Code to find a website cool enough for you? There's not a single thing wrong with PuTTY's UX either. The terminal area is just a ter…
> What more do you want from a website that only exists to distribute one program?
https
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#115If you are really concerned about security, why would you trust an prebuilt binary of an open source project. The source is available, just grab the source and build it your self. That way you at least know what you have.
You mean you can't tell what the program is doing by just glancing over the binary in a hex editor? /s
You have to be a pretty good programmer to identify obfuscated code in something like Putty I'd imagine - particularly as all the parts needed for snooping are intended to be there: certainly I (a non-programmer) couldn't guarantee to spot a reverse SSH connection being used for key-logging. Configure-make-install I can do but proper security level code review is not something I'd expect most programmers could do (otherwise we wouldn't have things like Heartbleed, surely?).
Web-of-trust in some form seems like the answer; but ultimately you need someone trustworthy to be paid (or equivalent) to do a proper review and oversee the securing/signing of that code as reviewed.
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#116Use Chocolatey. cinst putty and you're done. https://chocolatey.org/packages/putty
This is in their FAQ:
"How do I know if I can trust the community feed (the packages on this site?) Until we have package moderation in place, the answer is that you can't trust the packages here. ..."
Their about page:
"Package moderation and package signing are planned to increase the security of the community feed. Bear with us, this is going to take time to get into place. ..."
However moderation seems to be implemented (at least putty is approved by a moderator), I see no signing in place. At least everything seems to be going trough https and they are going in a good direction.
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#117Earlier quoted context omitted.
I certainly don't mean to jump down the dev's throat -- I have been using Putty for years (without, I must admit, a second thought about whether the binary might be compromised) with nothing but gratitude. And I don't think anyone else should direct their complaints at the dev either. My comments are addressed to those who complain, in a general way, that it is not easy enough for a developer to write trusted code. P…
I understand what you are saying about "Putty seeks to perform a security-critical function." and therefore it should take these things into account (in a perfect world). I don't speak for all developers, obviously, but I'd wager a guess that most developers don't code (for OS at least) to "corner the market" or essentially become and run a mini-corporation (Twitter, Blog, Github, HTTPS, Code Signing, Website w/ Land…
Sounds like we're in agreement.
But what can we do? I don't think it's realistic to expect anyone to issue code-signing certs for free. Any credible process for issuing the certs, it seems to me, would be too resource intensive for anyone but a charity to do for free.
For projects like Putty it probably won't be a problem to raise money for the cert, if the dev wants to go that route. But I don't know what's to be done about the dev who, understandably, just isn't interested in dealing with all that entails, or projects with smaller followings than Putty.
Do we need to start some sort of organization to help hobbyist and independent devs with this problem? Even if there were a group of people willing to take this on, (I might be), would it be a good idea? Taking on the responsibility of verifying a dev's identity and helping him or her with things like code signing certificates seems like a liability nightmare, for one thing.
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#118If you are really concerned about security, why would you trust an prebuilt binary of an open source project. The source is available, just grab the source and build it your self. That way you at least know what you have.
I just checked:
PuTTY's Windows source code is ~190 files, or ~123145 lines.
If you assume you can read a line a second (and you can't), that's more than 34 hours (!).
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#119Earlier quoted context omitted.
It's actually including a subset of cygwin built with a fork of mingw, which includes the openssh-clients. It's the same as if you installed cygwin and used ssh from that. That being said, when I'm looking for git and friends I like to go further and install more of cygwin to run the native port of rxvt and then run ssh inside of THAT. So it's not really a solution for a shell in the way that PuTTY is, since PuTTY al…
> I like to go further and install more of cygwin to run the native port of rxvt and then run ssh inside of THAT. Let me buy you a beer. I just run linux.
And I'd buy you the next round!
Dealing with mixed OS environments... it keeps you busy.
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#120Earlier quoted context omitted.
Wait... you think a terminal emulator, which by definition has almost no graphical UI at its heart, is crap because of its UI? Really? You think the entire program is crap because, what, you don't like how the Preferences panel is laid out?
To be fair, the only piece of UI in Putty that one needs besides the actual shell, namely adding and managing hosts that you connect, is absolutely broken beyond imagination. It has always been like that and it probably will be. Of course if one never ever uses the UI, then it's ok, but putty more or less forces one to use it.
I know exactly what you're talking about but "broken beyond imagination" is pushing it a bit.
I agree it's not obvious how to use that portion of the UI, and the UI is far from ideal, but once you understand how it switches profiles, then you're pretty much set. That issue doesn't occur again anywhere else in the application so it's a rather minor issue if you ask me.