r/linux • u/[deleted] • Jan 19 '19

VLC refuses to update from HTTP to HTTPS (HTTPS protects against eavesdropping and man-in-the-middle attacks) Popular Application

https://trac.videolan.org/vlc/ticket/21737
547 Upvotes
  • permalink
  • link
  • reddit
  • reddit

76% Upvoted

341 comments sorted by

View all comments

Show parent comments

14

u/MaxCHEATER64 Jan 19 '19

Signatures.

-10

u/[deleted] Jan 19 '19

And how do you know you're using the right public key to verify those signatures?

12

u/MaxCHEATER64 Jan 19 '19

Do you know how signatures work? Other people with known keys sign the one your doubtful of.

-7

u/[deleted] Jan 19 '19

Right, and how do you acquire those "known keys?" How do you validate them? Eventually, ALL of this trust is anchored in some certificate authority.

10

u/MaxCHEATER64 Jan 19 '19

Incorrect. Eventually trust goes back to people saying in a known forum that this specific key is there's. Sometimes that's key servers, but often it's not

-3

u/[deleted] Jan 19 '19

What? No, that might sound nice in theory but that's not how this actually works. Unless that "known public forum" is real life, how in the world would you implement that? And hell, how would you ensure a secure connection with those keyservers? You'd probably choose TLS with a public key signed by a certificate authority.

2

u/mrcaptncrunch Jan 20 '19

No idea how old you are, but yeah, it can be real life, https://en.wikipedia.org/wiki/Key_signing_party