Re: Extension security?

17.12.2011 03:04, Jasper St. Pierre kirjoitti:
If the website is hacked, the attacker has the GPG key anyway, so they
can sign a rogue extension. Unless I'm not understanding how the
website is supposed to automatically sign extensions after they've
been approved.

I don't understand where GPG comes into this discussion, if the Gnome shell client, which downloads and installs the extension does not check any signatures?

The point with cryptographic signatures would be that the extensions would *not* be signed automatically on the machine where the web service runs. Rather, after review, an maintainer (who might not be the same person as the reviewer) would use a different, non-public, machine where the private key is kept, and do the signing there. More work, yes, more secure, yes.

But it seems this was discussed previously, and Gnome shell authors decided not to do it this way (why?).

Pauli Virtanen

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]