On Mi Mai 13 2009, Tom "spot" Callaway wrote: > On 05/13/2009 04:32 PM, Till Maas wrote: > > I hope this is only misleading, but it looks to me that this test > > application demands the original FAS username/password from testers, > > which are then sent via an connection where the certificate cannot be > > easily verified by the testers. Also it is a bad idea to use these very > > important credentials in an application that may still have security > > flaws, because it is still in development. Last but not least this is > > also a bad education for the users that get used to provide their > > credentials to untrustworthy websites. > > I'm not entirely sure I follow this logic. Lots of things authenticate > against FAS. The source code for every bit of this web application is > open source and available for review. Do you trust Bodhi? How about > pkgdb? Or koji? Barring some specific security vulnerability (which you > haven't pointed out), this criticism seems unfounded. Koji requires a client SSL certificate for authentication, therefore afaik an attacker can only get access to the koji web interface using a man in the middle attack, i.e. changing the SSL certifcate of the koji webinterface atfter gettin in between the user and the webinterface. This is e.g. often easily possbile in networks of conferences. The other webservices (pkgdb and Bodhi) use a SSL certificate by a well know CA, therefore webbrowsers on Fedora systems can easier verify the certificate. Except of course in case the attacker posseses a rouge CA certifcate, that is signed by other CAs that are unluckily shipped with Fedora. Also I trust Bodhi, Koji and the Pkgdb more, because they are not announced to be trustworthy by their developers. You wrote in the announcement: | Please don't rely on this test instance for anything. For me this means, that one cannot rely on the test instane for protecting highly sensitive data, which the FAS credentials imho are. Also not using a good SSL certificate is already a first indication that security is not (yet) important for the test instance. The certificate seems not to be even signed by some private Fedora CA. Regards Till
Attachment:
signature.asc
Description: This is a digitally signed message part.
-- fedora-devel-list mailing list fedora-devel-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/fedora-devel-list
