X-Recipient: archive-cygwin@delorie.com DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:references:date:in-reply-to :message-id:mime-version:content-type; q=dns; s=default; b=phR9v mFuVe6wHYicJGfE4VqRrwtV6VPbEEwQU8ESAC5LF6CPJ1sKkaT7/S1BSEnR51S4z MDO+1NKd7aAVDNHLSFpHhLAkfhNT7hSBB6bA0Lhd0Qku0eqoxlsxb1MZ8HU5gjpR gFoGu1sN2c9TJhgC2J2IT4oL6da/6vza2vkGfQ= DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id :list-unsubscribe:list-subscribe:list-archive:list-post :list-help:sender:from:to:subject:references:date:in-reply-to :message-id:mime-version:content-type; s=default; bh=Uf1ceSke1k/ iaCKJiEkiWW5FLpk=; b=svHdcSg+h/LTjOKguQsw+9FXwQQvTMPghI54o/0gCNZ +s+mpgaa1PDQfDUCfjM7YADxohRj9gLXjiuCyNLkNgB43jMHisR/yXV48FDuX7m0 eqa2Tx3DkPmZitTq4mfvQ7vj3EghXSk4kBk1a0Ms1gZqQhL6YbGL0dN3gNBBPcd8 = Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: cygwin-owner@cygwin.com Mail-Followup-To: cygwin@cygwin.com Delivered-To: mailing list cygwin@cygwin.com Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-2.4 required=5.0 tests=AWL,BAYES_00,RCVD_IN_DNSWL_LOW,SPF_PASS autolearn=ham version=3.3.1 spammy=channel, attack, HX-Languages-Length:1252, HX-Spam-Relays-External:ESMTPA X-HELO: vsmx009.vodafonemail.xion.oxcs.net From: Achim Gratz To: cygwin@cygwin.com Subject: Re: SSL not required for setup.exe download References: <1a840c2e-55ac-0ab4-66c4-a1f6a2c4f81a@Shaw.ca> <41f12842-ea43-ff63-a660-26ee3b497c63@SystematicSw.ab.ca> <1b570593-0ec7-0890-26ef-7e7468534f47@SystematicSw.ab.ca> Date: Tue, 12 Mar 2019 20:21:48 +0100 In-Reply-To: (Archie Cobbs's message of "Tue, 12 Mar 2019 08:47:36 -0500") Message-ID: <87zhpz3nlf.fsf@Rainer.invalid> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Archie Cobbs writes: > Downloading the sig file over HTTP is useless... any attacker going to > the trouble to launch a MITM attack for setup.exe will certainly also > do it for the sig file as well. No, the signature would be rejected if you cared to actually check the key and signature (truly checking the key mandates a separate information channel that hopefully is not under the control of the attacker). Now, if you are postulating an attacker that can sign with the correct key, then there wouldn't be no need for a cleartext MitM attack in the first place. > OTOH, if you download the file over HTTPS.. then your client supports > SSL. Which is exactly what I'm saying should be mandatory. Well, everyone so far agreed with you that TLS is preferrable (although it isn't nearly as foolproof as you seem to believe). But you don't seem to grasp that not everyone can use it every time and that the fallback is actually better than the DoS that would result for folks that are cut off from doing (proper) HTTPS. Regards, Achim. -- +<[Q+ Matrix-12 WAVE#46+305 Neuron microQkb Andromeda XTk Blofeld]>+ Wavetables for the Terratec KOMPLEXER: http://Synth.Stromeko.net/Downloads.html#KomplexerWaves -- Problem reports: http://cygwin.com/problems.html FAQ: http://cygwin.com/faq/ Documentation: http://cygwin.com/docs.html Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple