Is the paranoia about verifying signatures really required?

Question

On the site about trusting the tails key, there is a lot of information about verifying that you have downloaded the genuine Tails signing key. I was wondering whether this paranoia is justified. To ask specifically:

1. As far as is known, has anyone ever hacked the tails website in general, and particularly has anyone edited the key maliciously to fool people?
2. Are there any recorded cases of someone being the victim of a man-in-the-middle attack while downloading the tails key?
3. Are there any known malicious versions of tails that have some key associated with them?

(for the record, my download of the key is here: http://pastebin.com/vdXiW9Vz. If that's not the real one, tell me :)

Answer 1

Yes. In fact, researchers recently discovered a rogue exit node that was modifying binary files! Know that Tor protects your anonymity, but that without end to end encryption you are vulnerable to MITM attacks. Some might say you are even more vulnerable since you're more of a target by using Tor.

It is an unfortunate fact that computer security is and always will be an ongoing process. Tools like Tor successfully make it much easier to 'do the right thing', but so far there are no perfect easy-to-use end to end solutions. Always validate everything you pull down using Tor (or off the internet in general for that matter).

Answer 2

Tails website got defaced by 'accident' a while back, luckily it did not become a larger issue then that, but it does show that you do need to be careful.

More info here: http://news.softpedia.com/news/Tails-OS-Website-Defaced-No-Need-to-Worry-448831.shtml

The problem is also that it can be very hard to detect that you have been a victim of a man in the middle attack unless you actually use the keys and verify your downloads. I always download from the official website and verify with the keys, better to be safe then sorry.

When exploits and such are discovered they are always posted on tor project's blog, or tails blog, and promptly fixed. I have not seen any information about compromised keys.

The bugtracker for Tails is located here: https://labs.riseup.net/code/projects/tails/issues?query_id=108 and can be searched.

As for malicious versions of tails - there is probably some floating around various torrent sites and such (which is unsafe to use regardless since they are unofficial ).

Answer 3

About reported victims: If such an attack really succeeds you will most likely never find out.

There have been various attacks in the past of the same governments that (want to) block Tor. There have been numerous occasions of governments even faking SSL signatures of websites, so you really want to make sure this isn't the case.

If you take time to download Tor or Tails you really should take that few seconds to minutes time to verify the signature.

Answer 4

Yes, it is very required. You can be a victim of man-in-the-middle attack without anybody else even noticing, so relying on an empty list of publicly known hacks is not satisfactory. Tails has an ambition to be resistive even from a government's surveillance (to the highest possible extent), and these guys have no problem forging the Tails certificate and carrying out a targeted attack.

It is a good practice to always verify the download, and also check your version of the PGP key with your friends, or taken from various machines, over a period of time...