| |||||||||||||
On the security of our processes and infrastructureOn the security of our processes and infrastructurePosted Sep 9, 2011 8:07 UTC (Fri) by Klavs (subscriber, #10563)In reply to: On the security of our processes and infrastructure by rweir Parent article: On the security of our processes and infrastructure
if the dev. used a PKCS#11 interface to sign (using a smartcard with a pin or whatever) f.ex. - would help that :)
But still - it'll take more patience and a keylogger, if they were signed.
(Log in to post comments)
On the security of our processes and infrastructure Posted Sep 9, 2011 16:39 UTC (Fri) by JoeBuck (subscriber, #2330) [Link] No, it wouldn't help. If the developer's system is compromised, the rootkit could see and intercept every action. The rootkit would simply wait for the developer to sign a commit, and then apply that signature to a different commit. The fact that the developer also had to enter a token from a smartcard or get her iris scanned is no defense if someone else owns the developer's machine.
|
|||||||||||||