{"action":"created","issue":{"url":"https://api.github.com/repos/canonical-websites/www.ubuntu.com/issues/4394","repository_url":"https://api.github.com/repos/canonical-websites/www.ubuntu.com","labels_url":"https://api.github.com/repos/canonical-websites/www.ubuntu.com/issues/4394/labels{/name}","comments_url":"https://api.github.com/repos/canonical-websites/www.ubuntu.com/issues/4394/comments","events_url":"https://api.github.com/repos/canonical-websites/www.ubuntu.com/issues/4394/events","html_url":"https://github.com/canonical-websites/www.ubuntu.com/issues/4394","id":380848886,"node_id":"MDU6SXNzdWUzODA4NDg4ODY=","number":4394,"title":"Ubuntu downloads are insecure and offer poor security usability","user":{"login":"eligrey","id":46995,"node_id":"MDQ6VXNlcjQ2OTk1","avatar_url":"https://avatars2.githubusercontent.com/u/46995?v=4","gravatar_id":"","url":"https://api.github.com/users/eligrey","html_url":"https://github.com/eligrey","followers_url":"https://api.github.com/users/eligrey/followers","following_url":"https://api.github.com/users/eligrey/following{/other_user}","gists_url":"https://api.github.com/users/eligrey/gists{/gist_id}","starred_url":"https://api.github.com/users/eligrey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eligrey/subscriptions","organizations_url":"https://api.github.com/users/eligrey/orgs","repos_url":"https://api.github.com/users/eligrey/repos","events_url":"https://api.github.com/users/eligrey/events{/privacy}","received_events_url":"https://api.github.com/users/eligrey/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2018-11-14T19:21:23Z","updated_at":"2018-11-24T00:13:47Z","closed_at":"2018-11-23T21:06:51Z","author_association":"NONE","body":"(This is a continuation of #822, which I do not believe was fixed)\r\n\r\nIssue #822 was closed with [this comment](https://github.com/canonical-websites/www.ubuntu.com/issues/822#issuecomment-360822489):\r\n\r\n> This issues is solved in the strictest sense, in that the guide at https://tutorials.ubuntu.com/tutorial/tutorial-how-to-verify-ubuntu can be trusted, as it is now served over HTTPS, and therefore the GPG fingerprints found on step 2 can also be trusted, allowing you to verify your download.\r\n\r\nThe principal issue is not solved. Giving users a how-to guide isn't a solution for users that will immediately use the downloaded ISO. There are only two solutions, and neither of them have been implemented.\r\n\r\n1. (Very easy solution) Serve releases.ubuntu.com over HTTPS. If I recall correctly this was already done in the past. Why has this regressed?\r\n2. (Harder solution) Automatically verify the GPG signature using a client-side GPG implementation hosted on the already-secured <https://www.ubuntu.com/download/desktop>. Add CORS headers to releases.ubuntu.com so that www.ubuntu.com can access the file contents to perform GPG verification automatically. Only save the file for the user if it passes the GPG signature check. If it doesn't pass the signature check, display an error message to the user saying that the download could not be verified and may be corrupted.\r\n\r\nConsider [this recent tweet by Matt Linton](https://twitter.com/0xMatt/status/1062782977212583936) when you think about security usability design:\r\n\r\n> Security can only be accomplished by writing secure software and making security easy.\r\n> \r\n> You cannot lay it on the feet of the users - it has to be the tools."},"comment":{"url":"https://api.github.com/repos/canonical-websites/www.ubuntu.com/issues/comments/441331967","html_url":"https://github.com/canonical-websites/www.ubuntu.com/issues/4394#issuecomment-441331967","issue_url":"https://api.github.com/repos/canonical-websites/www.ubuntu.com/issues/4394","id":441331967,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MTMzMTk2Nw==","user":{"login":"eligrey","id":46995,"node_id":"MDQ6VXNlcjQ2OTk1","avatar_url":"https://avatars2.githubusercontent.com/u/46995?v=4","gravatar_id":"","url":"https://api.github.com/users/eligrey","html_url":"https://github.com/eligrey","followers_url":"https://api.github.com/users/eligrey/followers","following_url":"https://api.github.com/users/eligrey/following{/other_user}","gists_url":"https://api.github.com/users/eligrey/gists{/gist_id}","starred_url":"https://api.github.com/users/eligrey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eligrey/subscriptions","organizations_url":"https://api.github.com/users/eligrey/orgs","repos_url":"https://api.github.com/users/eligrey/repos","events_url":"https://api.github.com/users/eligrey/events{/privacy}","received_events_url":"https://api.github.com/users/eligrey/received_events","type":"User","site_admin":false},"created_at":"2018-11-24T00:13:47Z","updated_at":"2018-11-24T00:13:47Z","author_association":"NONE","body":"@nottrobin You should also look into [Signed HTTP Exchanges](https://developers.google.com/web/updates/2018/11/signed-exchanges). It's basically solution #2 except there's no extra header necessary and the client-side validation code is already built-in to the browser."}}
{"actor":{"display_login":"eligrey"}}