Skip to content

Ask HN: Is the Tor Browser Developers GPG Key Attacked or Compromised?

4 pointsoil251 comment
On HN

When trying to download the Tor Browser Developers key to verify the download (as per https://support.torproject.org/tbb/how-to-verify-signature/), two working public key servers I know of return a 24.8 Megabyte file with over 26 million characters:

https://keys.gnupg.net/pks/lookup?op=get&search=0x4E2C6E8793298290
https://pool.sks-keyservers.net/pks/lookup?search=0x4E2C6E8793298290&fingerprint=on&op=index

Surely this can't be right. In fact, I'm worried about even trying to import them into GPG. Has someone vandalized or otherwise broken the signing keys?

Comments

Probably related to this:

https://nakedsecurity.sophos.com/2019/07/05/openpgp-experts-...

https://www.zdnet.com/article/openpgp-flooded-with-spam-by-u...

I'm sure I read in that last day or two about software updates to mitigate against this, but I can't find anything now.

There is a 2 day old release of GnuPG available - which isn't described on their release notes page (yet?):

https://gnupg.org/download/index.html

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.