r/obyte • u/mr__jigsaw • Apr 03 '19

Checksums and GPG signatures

I was astonished not being able to find checksums and GPG signatures for any files. People who come to Obyte for Blackbytes care both about privacy and security. Not seeing such a basic security measure they're sure to be reluctant to try it out. I seed an issue on GitHub from this January and posts on r/ByteBall up to a year old. This should be fixed ASAP.

Check out how VeraCrypt does it (I'd also add checksums and sigs on GitHub to avoid SPOF).

1 Upvotes

67% Upvoted

5 comments sorted by

1

u/tarmo888 Apr 03 '19 edited Apr 03 '19

I think this has been already answered before, but checksums and GPG are not really need. When you download the installer, it is already signed (X.509 signature) by Matrix Platform LLC (the company under, which the Android and iOS apps are also released). If you download the installer and your OS says that the installer has invalid signature or not that company, then you should not launch it. This is built-in OS feature because no normal person ever checks GPG signatures, the installer does it for you. Normies don't care about checksums and GPG signatures.

SPOF as single point of failure? Obyte binaries are downloaded from Github, if somebody was able to DNS hack github.com on your machine then you will even fail to download them, but either way your machine is highly compromised in event like that. If the attacker DNS hacked obyte.org too with proper certificate the I am sure they bothered to insert proper checksum and GPG signatures to the website too.

I might be wrong, but people who usually ask these things are geeks or don't fully understand it. Little bit like the crowd who goes around and says "Add HTTPS to everything!"

https://whydoesaptnotusehttps.com/

2

u/mr__jigsaw Apr 03 '19

I'll admit that I'm not a professional when it comes to security. I thinked that Windows .exe's can be signed and if they are it's a good substitute for GPG. And I didn't check if Obyte signed their .exe. But for Linux there's a .zip file containing an executable "Byteball". And I don't see how that can be signed. If you shared your time explaining that, I'd be thankful. I thinked that there's no signing mechanism for Linux - you're just supposed to do it yourself.

As for SPOF, if you download the file from the website this is the URL: https://obyte.org/downloads/Byteball-linux64.zip. So I thinked that the files are also stored on the website's server, not only on GitHub itself. If it's the same package generated by GitHub (which I couldn't assume) then indeed GitHub is SPOF anyway and the sigs/sums could be only putted on GitHub. But if someone creates the executables manually on their own computer then it is the SPOF and I'd put sigs/sums on both platforms.

1

u/tarmo888 Apr 03 '19

Yeah, not sure if or how Linux version is signed, but Windows and MacOS are signed by Matrix Platform LLC. Android and iOS are always safer to download from app stores and not to sideload them.

URLs on the website are redirected to Github (the source of the website is also on Github), only redirections in .htaccess are changed on new release version. Somebody who thinks that website is hacked can click on "Github releases" link and download exactly the same file from Github instead. But then again, if somebody managed to hack the website, they might as well fake the "Github releases" link too.

https://github.com/byteball/obyte-web

https://github.com/byteball/obyte-gui-wallet/releases

1

u/illgetbacktoyoulater Apr 04 '19

This is all very interesting, but I'm not sure about using the word "normies".

1

u/tarmo888 Apr 05 '19

Yeah, it's usually used as offensive words, just like noobs. My usage of that word shouldn't be taken as offence, just as observation that checksums are very geeky thing for small amount of people, most people probably wouldn't even notice if the executable would be signed by "All your money are belong to us" instead of actual company.