Discussion (4 Comments)Read Original on HackerNews

noman-land•about 1 hour ago

If the signing subkey was committed, that implies developers have it as a file on their system which I find surprising if true. They should be using hardware like a Yubikey or something. Especially for something this important.

Joel_Mckay•5 minutes ago

People don't need an extra supply-chain failure mode to consider, and CVE-2024-45770 proved these dongles are mostly security theater. Likewise, the recent Coinkite user key prediction breach certainly wasn't cool for folks that lost their holdings. =3

anon7000•about 1 hour ago

The signing key for Firefox stored on a single hardware yubikey available to a single person?

computerfriend•about 1 hour ago

Multiple hardware devices can have the same key.

Updated GPG Key for Signing Firefox and Thunderbird Releases

⚡ Community Insights

Discussion (4 Comments)Read Original on HackerNews