Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downloading PuTTY Safely Is Nearly Impossible (2014)

noncombatant.org

Post reply on HN
Print view View original

61–70 of 173 posts

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#61

Post by tptacek »

This is silly, Chris. :)

PuTTY is MIT licensed.

The primary author of PuTTY is unserious about traceable code, which is a shame, because as your essay implies, PuTTY is one of the motivating cases for traceable code. It's an actual lucrative real-world target for surreptitious replacement.

Clearly, the world cannot rely on PuTTY's author to provide a traceable download. Someone else needs to step in and do that.

That person can set up an HTTPS site, arrange to have their certificates pinned, get PGP-signed endorsements from people like you, the EFF, whatever, and --- given how awful PuTTY's SEO mojo is, easily take the top of the Google SERP for PuTTY with a reliable, traceable alternative.

What any of this has to do with WebCrypto is beyond me.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#62

Post by ChuckMcM »

Animats wrote: post #7
ChuckMcM wrote: post #2

This is really just a rant about how poorly PuTTY is distributed. (and a vague implication that it is malware of some sort). I think it is a valid criticism, and I wish the person who wrote PuTTy (an SSH client for windows) would be more open/available/transparent but it is hard to force that on someone.

This is not just a rant. As of two days ago, there is a hostile version of PuTTY in the wild.[1][2] It's on some mirror sites distributing open source software. It steals login credentials. Right now, it's essential to be able to tell the good one from the bad ones, and it's not easy. [1] http://www.symantec.com/connect/blogs/check-your-sources-tro... [2] http://blogs.cisco.com/security/trojanized-putty-software

Interesting, this should be in the original article as well! I used Putty a lot until I switched my desktop to Linux full time.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#63

Post by WorldWideWayne »

c22 wrote: post #44

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.

Windows does come with tools to establish a verified trust chain...it's just not using ssh. I'm not sure what you mean by authenticated package management, but Windows does authenticate packages that have certificates and you can manage certificates that you trust. What else do you want to do?

And I'm fairly certain that Windows comes with even more robust tools out of the box for network trust management than Linux does - at least when it comes to managing networks of Windows machines. I could be wrong. I don't know many people who run office networks full of Linux boxes for comparison and maybe there is really no "out of the box" with Linux...but Windows does have controls baked in for trust and security.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#64

Post by worklogin »

baldfat wrote: post #26
hughes wrote: post #4

Putty is pretty awful anyway. Git for windows installs a shell that is not terrible, includes an ssh client, and is distributed over https. It is my go-to when I have to use a windows machine.

I switched to mobaxterm [ http://mobaxterm.mobatek.net ] a few weeks ago. I am so happy with the program. It has some cool bells and whistles but it has built in X server. So it does X Forwarding out of the box.

Moba feels slow sometimes; I don't like its custom UI; I don't understand how it's FOSS /and/ has a pro-only version.

Its built-in SSH server is great for moving files to and from my workstation quickly when I need it.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#65

Post by joshu »

informatimago wrote: post #14

Downloading BINARY software safely is impossible indeed. Downloading SOURCE software poses no security risk. As long as only human read those sources, to check for this software behavior. WHEN the sources have been audited, and cleared for any security or other bugs, you may consider compiling them. That's where the real crux of the problem lies: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... http://…

You read all of Gentoo before compiling it?

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#66

Post by AlyssaRowan »

And to top it off, what size are his PGP signing keys? http://www.chiark.greenend.org.uk/~sgtatham/putty/keys.html

1024-bit RSA, and 1024-bit DSA.

Please see my comment earlier today about why that's Very Bad™ in the thread on the "Logjam" attack which shows that 1024-bit keys are too small for safe use now: https://news.ycombinator.com/item?id=9577998

Come on, Simon, I know you know better than that. It really is time to upgrade.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#67

Post by DangerousPie »

joshstrange wrote: post #39
Igglyboo wrote: post #33

Earlier quoted context omitted.

$73/year is not free but calling it "insanely expensive" is pretty unfair.

While I fully understand where you are coming from let's try and remember that putty is 100% free and I'd bet money the author puts in more time/energy/money than he gets back from it. That means that ANY money spent is more money in the hole making $73/yr ($219 all at once b/c you have to pay for 3 years) quite a bit of money.

That may be true, but it's so little that I'm sure he could find thousands of people/companies that would be happy to sponsor this. Including me.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#68

Post by Cacti »

astrodust wrote: post #31
cturner wrote: post #17

Earlier quoted context omitted.

What causes you to say that putty is pretty awful?

How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…

Wait... you think a terminal emulator, which by definition has almost no graphical UI at its heart, is crap because of its UI? Really? You think the entire program is crap because, what, you don't like how the Preferences panel is laid out?

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#69

Post by [deleted] »

Someone1234 wrote: post #6

None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's En…

[deleted]

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#70

Post by jdhawk »

baldfat wrote: post #26
hughes wrote: post #4

Putty is pretty awful anyway. Git for windows installs a shell that is not terrible, includes an ssh client, and is distributed over https. It is my go-to when I have to use a windows machine.

I switched to mobaxterm [ http://mobaxterm.mobatek.net ] a few weeks ago. I am so happy with the program. It has some cool bells and whistles but it has built in X server. So it does X Forwarding out of the box.

THANKS! I've been looking for something useable for a long time.
Post reply on HN