Hi!

On Wed, Dec 05, 2007 at 12:15:01PM -0500, bofh wrote:
quoted text
>On Dec 5, 2007 11:46 AM, new_guy <byte8bits@gmail.com> wrote:
>> Can you dismiss PKI and the benefits that OpenPGP signatures provide to your
>> user community? Knowing that xyz binary is signed by OpenBSD for
>> distribution or abc email came from an official OpenBSD source is a good
>> thing. Trojaned binaries and forged emails happen. PKI can help mitigate
>> this. The benefit of PKI is widely known and accepted and does not need to
>> be rehashed here. I'm surprised that OpenBSD (the most secure OS I know of)
>> does not use it, that's all I'm saying. I also thought there would be a real
>> reason for not doing so and there may in fact be and I may just be unaware
>> of it.

quoted text
>What are the risks you are trying to address?

One risk would be the plans of "online surveillance" of computers e.g.
in Germany. One way to install surveillance even on OpenBSD would be to
actively interfere with the internet connection with the surveilled
person, in the man-in-the-middle sense, and inject trojanned code
("Bundestrojaner") into the updates of the victim.

Using OpenBSD CDs doesn't protect the victim from attacks like that
that much because many people need ports/packages and to get fixes one
virtually has to use -current most of the time, and to update -current,
one often uses snapshots over non-secured transfers (ftp, rsync, source
via cvsync/cvsup). The only exception I know of is anoncvs via ssh,
but then, the CDs, IIRC, don't even ship with a known_hosts file for
the anoncvs servers.

As the talk about those "online surveillance" plans includes talk about
tailored attacks for each victim, they could investigate which OS one
uses and which ways of updating, so they could tailor their attack
vector appropriately.

Yes, *I*'d be vulnerable. I'd be not if I had a public key (and anoncvs
known_hosts file) from CD, perhaps also cvsync with cryprographic
integrity protection and public key (fingerprints) from CD, etc.

So the "online surveillance" stuff would perhaps not only affect Windoze
boxen as some people would come to think, even though the installation
of a trojan is, of course, usually much easier for Windoze than for
OpenBSD (or even a Linux installation if people with some skills operate
them).

Yes, of course cryptographic integrity protection wouldn't secure
OpenBSD against all kinds of attack vectors, but against *some*. Yes, it
comes at a cost. And I don't know whether the cost is really worth
while...

But I question whether it's really sound to just dismiss it beforehand.

quoted text
>[...]

Kind regards,

Hannah.