473 sats \ 38 replies \ @Natalia 24 Feb \ parent \ on: The Curious Case of Digital Signatures crypto
wait, so when the software was signed all you need to do is finding the correct public key ( the more sources suggesting the same key the better ), and then verify the asc? that's all?
Yes. The "asc" is the (detached) signature.
The hardest part is verifying the public key but most people just skip that lol
reply
how hard can it be, all you need to do is to search. 😂
reply
To be fair, I think if the instructions mention to import the key from a site like Keybase like Sparrow does, I think it's fine. Most important thing is to not import the public key from the same site you received everything else and I think if people just follow instructions, they automatically do that.
It just makes me feel uneasy if people are not aware that this is important. The why's and so on.
reply
It just makes me feel uneasy if people are not aware that this is important.
like @DarthCoin say - education is key 🔑
reply
Haha yes. Like a secret key hidden in plain sight.
reply
is my understanding correct?
the logic behind this is the dev uses his private key to sign the signature ( asc ) which then hash the software.
reply
Wait, no. The dev signs the software (or whatever). The signature IS the hash "encrypted" with the private key.
reply
hmmmm, I need to do more practice to understand it better, and I still don't get the part when you need to do the checksum or not? 👀
reply
reply
agree, and some of them are quite hard to search, e.g. Mullvad VPN, I couldn't find it in other places besides their site, madness.
updated
github ☑️ https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6
reply
updated github ☑️ https://github.com/mullvad/mullvadvpn-app/releases/tag/2023.6
I don't see a key fingerprint there 👀
reply
MullvadVPN-2023.6.pkg.asc
👀
why the devs are making things to tricky, is it really meant for people to verify! or just trust.
I have to do that myself, still figuring things out around PGP keys
same, I'm verifying all the software that I use, good things is I don't use many.
reply
That's a signature, not a key fingerprint 👀
do I have to revoke this message using a new signed message 👀👀👀
reply
then I couldn't find it other than their site - how is that possible, given how many people are using their tools. 😂
Once you’ve observed enough matching fingerprints from enough independent sources in enough different ways that you feel confident that you have the genuine fingerprint, keep it in a safe place.