The same is true if a CA certificate used to secure Windows or Firefox updates (or anything else that contains an updated list of "trusted" CA certificates) is compromised. Replace "CA certificate" with "GPG key" and it's equally true for Debian or Ubuntu (and there must be something analogous for Red Hat, but I don't know how secure-update works in RPM-land).
The only answer is to have as small a list of trusted keys as possible, and be very careful how they're secured...
Power management, mobile and firmware developer on Linux. Security developer at Aurora. Ex-biologist. mjg59 on Twitter. Content here should not be interpreted as the opinion of my employer. Also on Mastodon.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png){kind=small}
Re: So the OS can modify the keys?
Date: 2011-10-20 06:59 pm (UTC)The only answer is to have as small a list of trusted keys as possible, and be very careful how they're secured...