Opened 8 years ago

Closed 8 years ago

#3897 closed defect (duplicate)

TBB build does insecure download of source files

Reported by: tmpname0901 Owned by: erinn
Priority: Medium Milestone:
Component: Applications/Tor bundles/installation Version:
Severity: Keywords:
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor:

Description

A recent post on the Tor blog reminds us, in the wake of the DigiNotar debacle, of the importance of verifying signed files after downloading. So why then does the TBB build process download Tor source files insecurely, then fail to verify the signatures of the files?

See file ~/build-scripts/versions.mk, most recently found in the tor-browser-2.2.32-2-src.tar.gz tarball. First it explicitly ignores the certificate of the originating site ("wget --no-check-certificate") while getting the Tor and Vidalia source. Then it fails to download the signature files and check them against the downloaded source tarball files.

I urge that signed files actually be validated against their signatures in those cases where signatures are available.

Child Tickets

Change History (2)

comment:1 Changed 8 years ago by mikeperry

Component: Tor BrowserTor bundles/installation
Owner: changed from mikeperry to erinn
Status: newassigned
Version: Tor: 0.2.2.32

One more thing for you to automate, helix ;)

comment:2 Changed 8 years ago by rransom

Resolution: duplicate
Status: assignedclosed

Duplicate of #1348.

Note: See TracTickets for help on using tickets.