| |||||||||||||
On the security of our processes and infrastructureOn the security of our processes and infrastructurePosted Sep 9, 2011 2:46 UTC (Fri) by rweir (subscriber, #24833)In reply to: On the security of our processes and infrastructure by koverstreet Parent article: On the security of our processes and infrastructure
that doesn't really help with the "compromised dev laptop" attack, though.
(Log in to post comments)
On the security of our processes and infrastructure Posted Sep 9, 2011 8:07 UTC (Fri) by Klavs (subscriber, #10563) [Link]
if the dev. used a PKCS#11 interface to sign (using a smartcard with a pin or whatever) f.ex. - would help that :)
But still - it'll take more patience and a keylogger, if they were signed.
On the security of our processes and infrastructure Posted Sep 9, 2011 16:39 UTC (Fri) by JoeBuck (subscriber, #2330) [Link] No, it wouldn't help. If the developer's system is compromised, the rootkit could see and intercept every action. The rootkit would simply wait for the developer to sign a commit, and then apply that signature to a different commit. The fact that the developer also had to enter a token from a smartcard or get her iris scanned is no defense if someone else owns the developer's machine.
|
|||||||||||||