4 ms·
Very nice writeup! It contains a link to Avast's Coordinated Vuln Disclosure site: https://www.avast.com/coordinated-vulnerability-disclosure https://www.avast
by Leace 7y ago
Very nice writeup!
It contains a link to Avast's Coordinated Vuln Disclosure site: https://www.avast.com/coordinated-vulnerability-disclosure https://www.avast.com/coordinated-vulnerability-disclosure and this has a link to Avast PGP key that's served via unencrypted HTTP: http://virfile.avast.com/viruslab/avast-bugs-pgp-key.txt http://virfile.avast.com/viruslab/avast-bugs-pgp-key.txt Not only that, the key is a weak 1024 bit DSA key :(
- MarioMan 7y agoI'm hoping this isn't a dumb question, but why does it matter that a public key is public-facing and unencrypted?
- jurgemaister 7y agoIf someone intercepted the communication, they could swap the Avast key for their own, allowing them to decrypt your message.
- Leace 7y agoWhat jurgemaister said. If you don't have another trust mechanism (like Web of Trust) to validate if this is a correct key then HTTPS gives at least some assurance that no intermediaries between you and avast changed the key material.