[tor-bugs] #3861 [Tor bundles/installation]: begin signing Windows packages the Windows way

[Tor Bug Tracker & Wiki]

#3861: begin signing Windows packages the Windows way
--------------------------------------+-------------------------------------
 Reporter:  erinn                     |          Owner:  erinn
     Type:  enhancement               |         Status:  new  
 Priority:  normal                    |      Milestone:       
Component:  Tor bundles/installation  |        Version:       
 Keywords:                            |         Parent:       
   Points:                            |   Actualpoints:       
--------------------------------------+-------------------------------------

Comment(by ioerror):

 Replying to [comment:5 erinn]:
 > Yes, that is a very good summary of the situation. I don't think I
 decided not to bother -- it was left as a 'controversial' issue, but I
 think we should explore it more. Right now when you install one of our
 Windows packages, it comes from an 'Unknown' publisher which is much more
 trivial to spoof than one that claims to be from Tor Project, Inc. and has
 a key/cert/whatever to prove it.

 I worry that the attackers may beat us to the punch, what looks better a
 cert from "Tor Project, Inc." or a binary from "Unknown" parties?

 Bah, bad news all around.

 >
 > But to reiterate, I think we should explore this in more depth to see
 what the tradeoffs are. Because although it may be more difficult for
 someone to build a fake Windows bundle and then claim to be from us, it
 will also be much more convincing if they pull it off.

 I'm not sure that I totally understand this argument. It seems to me that
 it is likely that someone can build our software and currently impersonate
 "Unknown" - worse, we see that people simply don't even fetch package
 signatures for most projects that release them. Users are fine with this
 and don't do any checking almost all of the time, each time they install,
 I believe they are at risk.

 At least if we do Windows package signing, I believe that upgrades need to
 come from a valid cert chain - so you can't easily trick users into taking
 a backdoored package if they already had a good one. This is how android
 package signatures work. It doesn't prevent someone from making an
 identical app and marketing it but that is a separate issue, I think. I
 need to verify that it works similarly on Windows.

 In any case, I still think that it's better for another reason: the bar
 for owning a CA to impersonate The Tor Project is a lot more than simply
 typing "make" and having a package for insertion at MITM or phishing time.

-- 
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/3861#comment:6>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online