2

I just reinstalled Ubuntu so that I could take a more principled approach towards security with a fresh install.

The problem that I am having now is feeling confident installing software that isn't in the default package repositories. Right now I am trying to figure out TrueCrypt and Spotify.

My first attempt at asking for advice was regarding TrueCrypt and can be found on r/linux4noobs. Unfortunately I didn't get any responses.

TrueCrypt recommends checking the integrity of the installation tarball by downloading a signature, importing and signing their public key, and using something like 'gpg --verify'. I can download TrueCrypt's public PGP key directly from their website (sort of over HTTPS, but there doesn't appear to be any sort of SSL cert -- public key download) and confirm that it is the same one as is on MIT's PGP server. But since I haven't signed anyone else's PGP key, there's no way for me to know that the signatures that I see on MIT's PGP server for TrueCrypt are reliable. (I mean, I assume that they are, but that's not a great solution.) So it feels like there must be some way to bootstrap this process (without going to a keysigning event) for someone like me who just wants to check the integrity of software that I download. I now realize the importance of keysigning events, but it seems there should be another way as well. For example, why don't people/groups provide their public keys over HTTPS, using SSL certs as a bootstrapping mechanism?

In a similar vein, I am trying to install Spotify natively. They recommend adding their key using:

sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 94558F59

But I assume this all happens in the clear, without any signing. Checking signatures on their key, I used the following:

$ sudo apt-key adv --list-sigs

...

pub   2048R/94558F59 2012-06-25 [expires: 2015-06-25]
uid                  Spotify Public Repository Signing Key <[email protected]>
sig 3        94558F59 2012-06-25  Spotify Public Repository Signing Key <[email protected]>

It appears that the only signature is a self-signature. Again, I'm left feeling that I'm just kicking the can down the road. Sure, I'll be able to verify that the software I download was signed by the private key associated with the public key that I signed, but how do I gain confidence that the public key that I received belonged to who I thought it did?

I apologize for the wall of text, and if the answer is to read about PGP, I'm happy to. And I apologize for omitting links. Apparently without reputation only 2 links are allowed.

Thanks in advance for any help you can provide.

Improve this question
6
  • If you are downloading it via https, then you are using their SSL cert.
    – psusi
    Oct 20, 2013 at 0:21
  • @psusi I thought so. But going to truecrypt.org/download/TrueCrypt-Foundation-Public-Key.asc shows a grey globe in firefox indicating the web site either didn't supply identity information or the connection is only partially or not at all encrpyted. And when I go to 'tools/page info' there's not any more information. I've never seen a grey globe next to https before. Perhaps, however, there is a certificate and all of the traffic is being signed?
    – Josh
    Oct 20, 2013 at 0:40
  • That would be because the link you provided just redirects you to the main web page without ssl.
    – psusi
    Oct 20, 2013 at 0:57
  • @psusi Sorry, not sure what happened with the link. In firefox, 'copy link location' has the correct link, but I do see that clicking the link is redirecting to the homepage. It appears that I am unable to create a link that works correctly...
    – Josh
    Oct 20, 2013 at 1:03
  • @psusi Using wireshark I see that I do receive a certificate for TLS. The common reason for the grey globe with https seems to be loading some resources over HTTP instead of HTTPS, but using the console in firefox, I am only seeing a single GET request and it is using HTTPS. So I'm at a loss.
    – Josh
    Oct 20, 2013 at 1:38

1 Answer 1

Reset to default
0

TrueCrypt

Their key is available on the keyservers (for example on Ubuntu's). It has also quite a bunch of signatures, so you could be able to build a trust path to that key.

Building a trust path cannot work if you do not trust any other keys. Going to some keysigning event (or just find some guys to sign key's with, have a look at biglumber is the best way for being able to trust in their key.

Another chance would be to trust CAcert respectively their OpenPGP key. They're also signing OpenPGP keys and have a huge reputation in the web of trust. But it requires trusting them, decide yourself -- I do.

Spotify

Checking the key on various keyservers confirms your concerns, they did not do any keysigning. There is no way to find a trust path between you and Spotify.

An advantages still available: If you trust that key (gpg --edit-key 94558F59, then trust), you will be able to realize future changes of the key. You do not know if the key is really owned by Spotify right now, but nobody will be able to trick you into bad software in future (given that you had the right key right now).

You also might want to report a bug to Spotify that they should get their key signed.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .