| 1 |
On Sat, 19 Aug 2017 10:25:02 +0200 Michał Górny wrote: |
| 2 |
> Explicitly warn about any URI that uses an unsecure protocol (git, http) |
| 3 |
> even if it's a fallback URI. This is necessary because an attacker may |
| 4 |
> block HTTPS connections, effectively forcing the fallback to |
| 5 |
> the unsecure protocol. |
| 6 |
[...] |
| 7 |
> + local r |
| 8 |
> + for r in "${repos[@]}"; do |
| 9 |
> + if [[ ${r} == git:* || ${r} == http:* ]]; then |
| 10 |
> + ewarn "git-r3: ${r%%:*} protocol in unsafe and may be subject to MITM attacks" |
| 11 |
> + ewarn "(even if used only as fallback). Please use https instead." |
| 12 |
> + ewarn "[URI: ${r}]" |
| 13 |
> + fi |
| 14 |
> + done |
| 15 |
> + |
| 16 |
|
| 17 |
Sigh... https also makes MITM attacks possible, especially if SSL |
| 18 |
or TLS < 1.2 is used or are allowed and protocol version downgrade |
| 19 |
attack may be performed. |
| 20 |
|
| 21 |
Such messages create a false impression of a safety of https. |
| 22 |
Safety more or less can be gained by verifying GPG signatures and |
| 23 |
fingerprints of the upstream commits, if upstream supports this. Of |
| 24 |
course using https is better than using http or git, but better |
| 25 |
only by a bit. |
| 26 |
|
| 27 |
Best regards, |
| 28 |
Andrew Savchenko |
Archives