Last modified: 2014-01-21 23:39:21 UTC
For submitting information to security@mediawiki.org a public key is missing. I suggest the creation of such a key and the publication on the key servers and of key and fingerprint on https://www.mediawiki.org/wiki/Manual:Security .
(see also https://secure.wikimedia.org/keys.html)
/me notes these aren't exactly state secrets. I highly doubt we have to worry about someone intercepting emails to learn about an XSS attack on Wikipedia. That said , it doesn't really hurt anything to have such keys available for the paranoid.
I say: one can never know what will happen (see FLAME). I did not say that all mails must be sent encrypted. I just proposed to have a public key available in case that someone prefers to sent their mail encrypted.
Well if someone with the resources to create something on the scale of the flame malware decides to start hating on us, we probably have larger problems ;) Nonetheless, it certainly doesn't hurt to have such a key available.
CC'ing Chris as this is security related. Chris: Any comments?
I think it would be good to have a public key for this use. It's a pretty common practice, and almost no cost to us. Just need someone to generate the keys, distribute them, and post the public part in a few places.
Plus key should probably be on http://www.mediawiki.org/wiki/Security . For reference, https://www.mozilla.org/security/#pgpkey
This would pretty much require a shared private key by everyone on the security@ mailing list, so we should also post disclaimers that it's only for encryption, and shouldn't be relied on for signatures. Should someone generate a key and distribute it?
(In reply to comment #8) > This would pretty much require a shared private key by everyone on the > security@ mailing list, so we should also post disclaimers that it's only for > encryption, and shouldn't be relied on for signatures. You can do this (1, 2, 1+2): 1. (recommended) You can give a longer meaningful and describing name and/or comment, like "Wikimedia/MediaWiki/Wikipedia Information Security Team - read by several persons <security@mediawiki.org>" , and you could enumerate all team members by their name, in the comment field. 2. (optional, but requires all InfoSec team members to create an own key) You can sign the "community key" by every team member, so that it is clear, who is member. try gpg --gen-key to generate a test key, notice the optional comment field! Sorry: I tried, but I couldn't find the maximum key comment field length. The uploading to the keyservers is optional, the most important thing is that you publish the key and the fingerprint on a safe mediawiki site.
