Consider providing repomd.xml hash over https

[marmarek]

Reported by marmarek on 4 Sep 2014 20:30 UTC
https://groups.google.com/d/topic/qubes-devel/39k347Du_D4/discussion

This will make MITM attack at least harder. Currently (unsigned metadata downloaded over plain http) makes MITM attack trivial and user will not even get any error message when someone subvert the connection. Making it HTTPS at least will give some error message when someone will try to keep you away from updates.

Migrated-From: https://wiki.qubes-os.org/ticket/891

[marmarek]

Comment by marmarek on 4 Sep 2014 20:32 UTC
IMHO it can use self-signed (or private CA) certificate, specifically listed in yum settings for Qubes repositories (sslcacert option for repository definition).

[marmarek]

Comment by marmarek on 4 Sep 2014 20:32 UTC
IMHO it can use self-signed (or private CA) certificate, specifically listed in yum settings for Qubes repositories (sslcacert option for repository definition).

[marmarek]

Comment by joanna on 8 Sep 2014 09:53 UTC
Even if we wanted to use a special-purpose cert (so not-so-trusted, with priv key kept on the server) for this, the question remains about how to whitelist the CAs for yum? Without that this would be pretty meaningless...

https://groups.google.com/d/msg/qubes-users/qluZgegOnO8/odz_zxtOkkUJ

[marmarek]

Comment by joanna on 8 Sep 2014 09:53 UTC
Even if we wanted to use a special-purpose cert (so not-so-trusted, with priv key kept on the server) for this, the question remains about how to whitelist the CAs for yum? Without that this would be pretty meaningless...

https://groups.google.com/d/msg/qubes-users/qluZgegOnO8/odz_zxtOkkUJ

[marmarek]

Comment by marmarek on 8 Sep 2014 09:59 UTC
You can provide CA whitelist per-repo, so we can simply place there self-signed cert for Qubes repositories and leave the defaults for other (Fedora) ones.

[marmarek]

Comment by marmarek on 8 Sep 2014 09:59 UTC
You can provide CA whitelist per-repo, so we can simply place there self-signed cert for Qubes repositories and leave the defaults for other (Fedora) ones.

[marmarek]

Modified by joanna on 8 Sep 2014 10:00 UTC

[marmarek]

Modified by joanna on 8 Sep 2014 10:00 UTC

[marmarek]

Alternatively we can use signed metadata (same as Debian uses by default). This will also help with implementing updates-freeze attack detection. Details here:
https://groups.google.com/d/msgid/qubes-devel/5520B680.5030701%40whonix.org

[marmarek]

Alternatively we can use signed metadata (same as Debian uses by default). This will also help with implementing updates-freeze attack detection. Details here:
https://groups.google.com/d/msgid/qubes-devel/5520B680.5030701%40whonix.org

[andrewdavidwong]

Just doing a routine check: Is it still correct that @rootkovska is assigned to this issue?

[andrewdavidwong]

Just doing a routine check: Is it still correct that @rootkovska is assigned to this issue?

[marmarek]

No.

[marmarek]

No.

[andrewdavidwong]

@marmarek: Is there any special reason that yum.qubes-os.org and deb.qubes-os.org use HTTP instead of HTTPS in repo definitions by default? Should we switch them all to HTTPS?

[andrewdavidwong]

@marmarek: Is there any special reason that yum.qubes-os.org and deb.qubes-os.org use HTTP instead of HTTPS in repo definitions by default? Should we switch them all to HTTPS?