-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 03/01/2015 05:45 PM, Marco Zehe wrote: > Hi Kristian, > >> Am 01.03.2015 um 17:36 schrieb Kristian Fiskerstrand >> <kristian.fiskerstr...@sumptuouscapital.com>: >> >> Seriously? Please look at >> https://bugzilla.mozilla.org/show_bug.cgi?id=790487regarding that >> implementation, which opens up another can of worms (encrypts >> to {S,C} key, not encryption key, dual usage of same key material >> for different purposes... BAD) > > Do you have any insight to share in that bug that might help my > colleagues move fixing it forward? I’m sure it would be highly > appreciated! :) >
Since the author's first reaction was closing it WONTFIX I didn't bother, with that kind of behavior they can't possibly take security seriously. The proper solution seems to be a re-implementation of the system to use gpgme for encryption. I'm also worried about the system's key management in the case of (i) revocations; as I'm not aware of any key refreshes being made, meaning a revocation certificate uploaded to public keyserver network would not be honored and still constitute information leak. (ii) Ditto for the issue of replacing the subkeys, as key rotation would not be automatically taken into consideration and would have to be uploaded manually to each bugzilla implementation using that flawed piece of software (the securemail extension, not bugzilla itself). - -- - ---------------------------- Kristian Fiskerstrand Blog: http://blog.sumptuouscapital.com Twitter: @krifisk - ---------------------------- Public OpenPGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3 - ---------------------------- Timendi causa est nescire The cause of fear is ignorance -----BEGIN PGP SIGNATURE----- iQEcBAEBCgAGBQJU80QyAAoJEP7VAChXwav6NLcH/2mkfs2MRRHhSc1ZcEVWstJ5 0ZDSGVHUDsAFqUGxXyxbOj+nc1yrZBlQCxFhd3dogtIMYUDkCckEDEIahT029jsL dJ3GvXjf3ZdKKCsIl+MTypr1ToyMJ0r0DpTv90XxdX97svdc7VUi5wIMdNiL3mbV dLbUXt8e1qTt1Y9ie08vhGVmSP3IesSztLlWkxyIPL7NFDNqMwTUCk/RAZx4qwpT Ore/QxzBYlBrauYJpyUrNhKX6atF1GmCT8w0AKI1E55TUJSDmadOzt8T4rGYRkD0 Hz3OWjdGsUETjDy0JFbwnky1a+RBKXqrEtmHmFw+5dE6IiqEXKe+hBrTRlMqQUQ= =g23o -----END PGP SIGNATURE----- _______________________________________________ Gnupg-users mailing list Gnupg-users@gnupg.org http://lists.gnupg.org/mailman/listinfo/gnupg-users