Opened 2 months ago

Closed 2 months ago

Last modified 7 weeks ago

#31168 closed task (fixed)

audit openpgp keys for flooding

Reported by: anarcat Owned by: hiro
Priority: Medium Milestone:
Component: Webpages/Website Version:
Severity: Normal Keywords:
Cc: traumschule, trac-dip-importer Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

some OpenPGP keys used by the tor project might have been flooded alongside other keys in the network. make sure we don't point to those keys anywhere in the documentation and provide our users with sane keys that will not make GnuPG explode on their computers.

known bad:

Child Tickets

Change History (7)

comment:1 Changed 2 months ago by anarcat

a workaround is implemented through WKD in #31184, so this is just a matter of making sure we don't link to bad keys in the live docs.

comment:2 Changed 2 months ago by weasel

2019.www.tpo is an *archive* of the *old* website. It should not be changed.

If anything, we might want to set it to send a noindex robots header

comment:3 Changed 2 months ago by arma

I hear that the tor browser signing key will soon be reachable from
https://openpgpkey.torproject.org/.well-known/openpgpkey/torproject.org/hu/kounek7zrdx745qydx6p59t9mqjpuhdf

It would be a good idea to point to that location rather than giving people instructions to get a broken key from a broken keyserver.

comment:4 Changed 2 months ago by pili

The instructions to verify signatures are actually outlined in the support portal: https://support.torproject.org/tbb/how-to-verify-signature/

We probably want to:

  1. Remove the link to ​https://2019.www.torproject.org/docs/signing-keys.html.en from the support portal page

(1.a.) Replace the above link with another link/the correct content

  1. Update the "verify signature" instructions to not point to pool.sks-keyservers.net

comment:5 Changed 2 months ago by ggus

Ok, submmitted a merge request fixing Pili's 1 and 2.

comment:6 Changed 2 months ago by emmapeel

Resolution: fixed
Status: newclosed

merged, thanks!

comment:7 Changed 7 weeks ago by anarcat

i think the only thing that might remain here are the *other* signing keys listed in the 2019 document, but i guess we can live with that for now...

Note: See TracTickets for help on using tickets.