Security and Usability Issues of Clear Signed Checksum Files

[py0xc3 (Chris)]

Feel free to add thoughts / comments:

Social engineering attack -> no best practices in crypto on website: how to contact website team to solve that? (no immediately exploitable vulnerability, but practical in future in some circumstances)

The user @dobymick made us aware that there is an issue with the verification of signatures in the way we provide ISO files on our servers. It is a best practice to ensure end to end verification to our users, which means, the users should be able to verify that the ISO files they get from the mirrors are equal to the files we originally provided to the mirrors. The current process is prone to a manipulation that many users are likely to not identify: ISOs and CHECKSUM files are currently pro…

I have created a whole case with an attack scenario, so that it can be considered as such. This also makes it more comprehensible. Maybe I need to open a ticket in pagure or so, not yet sure, as I don’t know off the cuff which team is responsible. But we’ll find out