Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Eeeesh. Mozilla, wake up to build and signing processes from 20 years ago, please. Don't embarrass yourselves like this.by skullone
- It is insane that this key is not kept in a HSM.
It would be good if there way a way to attest that a key was generated on and bound to a specific HSM.
by angry_octet - Isn't this the sort of thing TUF[1] was invented to combat ?by traceroute66
- And this is why Microsoft requires signing keys to live in hardware for signing code.by charcircuit
- I’m surprised that the signing key lives on a non-airgapped system. A sophisticated attacker won’t be leaving any traces.by iamnothere
- If the signing subkey was committed, that implies developers have it as a file on their system which I find surprising if true. They should be using hardware like a Yubikey or something. Especially for something this important.by noman-land
- While TFA indicates that "committed" here refers to an inadvertent `git commit`, it is important to note that, in cryptography, there are some very important meanings of "committed key" that are useful and desirable. TFA does not mention these:
Key-committing AEAD: https://en.wikipedia.org/wiki/Authenticated_encryption#Key-c...
Signing Git commits: https://docs.github.com/en/authentication/managing-commit-si...
- People don't need an extra supply-chain failure mode to consider, and CVE proved these dongles are mostly security theater. Likewise, the recent Coinkite user key prediction breach certainly wasn't cool for folks that lost their holdings. =3by Joel_Mckay
- The signing key for Firefox stored on a single hardware yubikey available to a single person?by anon7000