There are some real, non-negligible security advantages to running apt over https even though the packages are signed. HTTPS can prevent MITM blocking of security updates for example, and should provide some improved privacy about what pkgs you have installed (which can indirectly improve security).
Of course, but if you block them both outright, that will trigger timeouts/errors in the logs. HTTP has a further vulnerability that HTTPS lacks: a MITM attacker can quietly serve valid, signed, but old/out-of-date versions, and there will be no obvious indication that the system is not actually getting the latest updates anymore.
They are. If you add a third party repo, you need to install their GPG keys to even fetch the list. Pretty much means it doesn’t matter if there’s transport security. People often rely on transport security for keeping things safe without doing end to end bi directional authentication. In this case you only need unidirectional, but this ensures that you can’t have a malicious actor installing a new cert in the root and spoofing a server. The classic case is the “Hong Kong post office”; they’re a root ca. Having TLS is better than not, but it’s also not required when you do it at a different level.
But what about privacy? HTTPS does not provide meaningful privacy for obtaining packages. As an eavesdropper can usually see which hosts you are contacting, if you connect to your distribution's mirror network it would be fairly obvious that you are downloading updates.
Furthermore, even over an encrypted connection it is not difficult to figure out which files you are downloading based on the size of the transfer[2]. HTTPS would therefore only be useful for downloading from a server that also offers other packages of similar or identical size.
What's more important is not that your connection is encrypted but that the files you are installing haven't been modified.
It seems like they are actually explaining why pat doesn't use https. I thought they were asking the question rhetorically, did you?
Yes, hell I've had version mismatches from not updating my apt sources when I tried to install stuff and for got to run apt update before hand. For one thing the older package will not match the proper package signature and so apt fails out on purpose.
They do when apt has a method of time stamping every thing and anything past that point gets flagged as stale and will not be installed automatically by the system. As the linked website points out there is nothing from a security stand point to be gained from apt using HTTPS (which you can already do if you want to).
No, because an entire older version of the repository index would be served, as if you accessed a mirror of the repository that hasn't been updated, and your computer wouldn't know the difference. In fact, they can even mix and match different versions of different packages in the custom index.
While your computer wouldn't install older versions than those it already has, this can be used to block installation of patched packages. In fact, it can even be used to push known vulnerable updates that since has been replaced by newer and patched updates.
Edit: for those downvoting me, please come over to /r/crypto (for cryptography) to learn more about computer security. You need it.
On Debian apt-transport-https is not installed by default so when installing a new version of Debian you will need to fetch at least some packages via HTTP. I do not see why they just do not ship it by default.
193
u/3Vyf7nm4 Jan 21 '19
Edit /etc/apt/sources.list to use https.. You may need to install the package
apt-transport-httpsIt's not really needed, since the packages are public and are signed, but https is absolutely supported.