{"action":"created","issue":{"url":"https://api.github.com/repos/andyholmes/gnome-shell-extension-gsconnect/issues/267","repository_url":"https://api.github.com/repos/andyholmes/gnome-shell-extension-gsconnect","labels_url":"https://api.github.com/repos/andyholmes/gnome-shell-extension-gsconnect/issues/267/labels{/name}","comments_url":"https://api.github.com/repos/andyholmes/gnome-shell-extension-gsconnect/issues/267/comments","events_url":"https://api.github.com/repos/andyholmes/gnome-shell-extension-gsconnect/issues/267/events","html_url":"https://github.com/andyholmes/gnome-shell-extension-gsconnect/issues/267","id":374388044,"node_id":"MDU6SXNzdWUzNzQzODgwNDQ=","number":267,"title":"Deprecate/remove DSA","user":{"login":"rugk","id":11966684,"node_id":"MDQ6VXNlcjExOTY2Njg0","avatar_url":"https://avatars3.githubusercontent.com/u/11966684?v=4","gravatar_id":"","url":"https://api.github.com/users/rugk","html_url":"https://github.com/rugk","followers_url":"https://api.github.com/users/rugk/followers","following_url":"https://api.github.com/users/rugk/following{/other_user}","gists_url":"https://api.github.com/users/rugk/gists{/gist_id}","starred_url":"https://api.github.com/users/rugk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rugk/subscriptions","organizations_url":"https://api.github.com/users/rugk/orgs","repos_url":"https://api.github.com/users/rugk/repos","events_url":"https://api.github.com/users/rugk/events{/privacy}","received_events_url":"https://api.github.com/users/rugk/received_events","type":"User","site_admin":false},"labels":[{"id":1106238793,"node_id":"MDU6TGFiZWwxMTA2MjM4Nzkz","url":"https://api.github.com/repos/andyholmes/gnome-shell-extension-gsconnect/labels/security","name":"security","color":"ffdd00","default":false},{"id":839570581,"node_id":"MDU6TGFiZWw4Mzk1NzA1ODE=","url":"https://api.github.com/repos/andyholmes/gnome-shell-extension-gsconnect/labels/upstream","name":"upstream","color":"ff9000","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-10-26T13:38:24Z","updated_at":"2018-11-06T03:08:26Z","closed_at":null,"author_association":"NONE","body":"This issue has already been brought up in https://github.com/andyholmes/gnome-shell-extension-gsconnect/issues/83#issuecomment-429296303, but I strongly suggest to track it properly in a specific issue.\r\n\r\nSo as far as I understand:\r\n* DSA is still used by the current Android app.\r\n* Oreo+ devices will have RSA in the next device. (So what is about old devices?)\r\n* I is used only used for sftp as far as I see, as the rest of KDE Connect uses TLS, AFAIK.\r\n\r\nAs this is a security issue is **very obvious**. They have been disabled in [OpenSSH in 2015(!!) e.g.](https://www.gentoo.org/support/news-items/2015-08-13-openssh-weak-keys.html).\r\n\r\n> Generally ssh-dss is deprecated because it is possible to break with current technology allowing an attacker to impersonate you, but still not decrypt a session.\r\n\r\nYes, and when they can impersonate you, they can do a Man-in-the-middle attack and thus catch everything what you send. This is effectively breaking the encryption.\r\n\r\nThere is no way around it. In the shorter or longer time you have to remove it. At some point of time you really need to show a warning for \"insecure connection\" (\"legacy connection\" or so) as to make users aware that some component/device needs to be upgraded.\r\nOf course this requires that RSA support is present in all KDE Connect implementations."},"comment":{"url":"https://api.github.com/repos/andyholmes/gnome-shell-extension-gsconnect/issues/comments/436116342","html_url":"https://github.com/andyholmes/gnome-shell-extension-gsconnect/issues/267#issuecomment-436116342","issue_url":"https://api.github.com/repos/andyholmes/gnome-shell-extension-gsconnect/issues/267","id":436116342,"node_id":"MDEyOklzc3VlQ29tbWVudDQzNjExNjM0Mg==","user":{"login":"andyholmes","id":1265208,"node_id":"MDQ6VXNlcjEyNjUyMDg=","avatar_url":"https://avatars0.githubusercontent.com/u/1265208?v=4","gravatar_id":"","url":"https://api.github.com/users/andyholmes","html_url":"https://github.com/andyholmes","followers_url":"https://api.github.com/users/andyholmes/followers","following_url":"https://api.github.com/users/andyholmes/following{/other_user}","gists_url":"https://api.github.com/users/andyholmes/gists{/gist_id}","starred_url":"https://api.github.com/users/andyholmes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/andyholmes/subscriptions","organizations_url":"https://api.github.com/users/andyholmes/orgs","repos_url":"https://api.github.com/users/andyholmes/repos","events_url":"https://api.github.com/users/andyholmes/events{/privacy}","received_events_url":"https://api.github.com/users/andyholmes/received_events","type":"User","site_admin":false},"created_at":"2018-11-06T03:08:26Z","updated_at":"2018-11-06T03:08:26Z","author_association":"OWNER","body":"So, as mentioned in the release notes for v15, the latest release of the Android app (v1.10) doesn't rely on DSA encryption anymore and GSConnect (and KDE Connect) will already prefer RSA encryption.\r\n\r\nIt should be *at least* a week or two before there are enough changes to release a v16, but I think we can be sure everyone has upgraded by then, so we can target DSA removal for that release. This will also help with #83 since we'll know we don't need to do anything weird with GIO."}}
{"actor":{"display_login":"andyholmes"}}