2

After I verified the key for the Tor Browser I got this error message (translated from Swedish):

gpg: WARNING: This key is not certified with a reliable signature!

gpg:           There is nothing that indicates that the signature belongs to the owner.

But the keys displayed in cmd are correct

Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290

Underkey fingerprint: BA1E E421 BBB4 5263 180E  1FC7 2E1A C68E D408 14E0

What should I make of that?

|improve this question
1

It means that you never signed the key that was used to sign the Tor Browser Bundle. You should only sign keys of people that you have verified the identity of (usually by looking at the person's government issued ID when meeting the person in "real life", though people have their own criteria for identification).

The message is warning you that you should make sure the key actually belongs to the person you think it does (in this case, the Tor Browser Developers).

If you got the message about the signature being good and if the key fingerprint matches the key fingerprint you expected, that is good. You still have to consider how you obtained the expected fingerprint. Ideally you would meet the person who owns the key in person and verify that the fingerprint is actually their's. It isn't always possible to travel to meet people in person. There is something called the web of trust. The idea is that if you meet me and verify my key and if I meet the Tor Browser Developers and verify their key, then if you trust me, you can trust that the Tor Browser Developers' key is actually their key, based on my having signed their key. This concept can be extended so that there are more people between you and the Tor Browser Developers. The more people you trust that have all verified the key of the Tor Browser Developers, the better.

Having said all that, it may be enough for you to just verify the keys off of the Tor Project website. I don't know exactly what you are doing and what kinds of threats you want to protect against.

If you haven't checked it out already, there is a page on the Tor Project website about this.

|improve this answer
  • I followed the instructions written for Windows EXACTLY as they are written here: torproject.org/docs/verifying-signatures.html.en I imported the key and verified via the command prompt! The download worked. The keys are correct. What else can I do? How am I supposed to get the correct signature from the developers other than via the download link on the instruction page? Hey, developers! Wanna meet me and exchange the key fingerprints? Lol! – SignatureMess Aug 2 '15 at 23:49
  • That's really up to you. It may be enough to have done what you did. Only you can say what you are comfortable with. And as I said, it may just not be practicable for you to exchange key fingerprints in person. If you can't exchange key fingerprints in person, then you really did all you can do. – Joseph Bisch Aug 3 '15 at 0:25
  • OK, I understand. That warning message is just there to tell that I can't be 100% sure I can trust the developers because I don't know them, sort of, and that it's up to me to add some kind of certificate if I think I can trust them, is that correct? But if the keys match the keys on the download page at least I could trust that those that wrote the keys on the download page also wrote the program, is that correct? – SignatureMess Aug 3 '15 at 12:34
  • Almost. It's not telling you that you can't be sure you trust the developers. It's actually saying that the you can't be sure the key you found on the website is really the developer's key. But you are right that you add something (a signature) if you know the key belongs to the developer. But you're not supposed to sign just because you see the key on some website. You are supposed to verify identity in person. And if the keys match the keys on the download page, then it indicates the key owner approved the program, not necessarily wrote it, though usually it means both. – Joseph Bisch Aug 3 '15 at 12:43
  • And there is the potential that a certificate authority can issue a fake SSL certificate for torproject.org, allowing someone to trick you into thinking you are visiting the real torproject.org, when you really aren't. – Joseph Bisch Aug 3 '15 at 12:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.