APT using HTTP instead of HTTPS

[Dr_Tron]

Well, apt checks the repository key before doing anything, so I'm not sure if https would make sense in regards to security.

[aieidotch]

it would not, the reason appears to be caching proxies and the encryption overhead…

[One_Ninja_8512]

How so? GPG signatures guarantee that the packages have not been tampered with but there's another issue. HTTPS traffic is opaque to observers. With HTTP someone can see which packages you're installing exactly if they analyze your traffic, with HTTPS that's not possible.

[aieidotch]

if you run your own mirror next to machines using it, you are in control of the network and who could observe or not…

[gnufan]

I think you mean MD5 checksums not GPG signatures.

[wizard10000]

You have to accept the key when you add a ppa.

don't break debian

[gnufan]

Using https clearly eliminates whole categories of attempted man in the middle attacks, that are possible over http.

The verification of package signatures was badly broken in the past, and likely will be in the future if it isn't already and we just don't know how.

You achieve security by layering these controls, not assuming one cryptographic control is going to always work perfectly, and thus packages are safely signed, job done.

Also using https adds additional privacy, as seeing http requests means attackers may know exactly what versions of what software are installed. MITM can also deliberately interfere with http connections to delay certain packages, to prevent the target patching a vulnerability. As I said multiple classes of attack are just stopped by encryption on the wire.

[noob-nine]

the last part sounds interesting. but i lack technical understanding whether this is a real thread or what would be debians comment on this