Skip to content

Conversation

@thefifthsetpin
Copy link

Proposed changes

I replaced a truncated cryptographic fingerprint with the full fingerprint. My rationale:

  1. As you're providing the apt command for easy copy & paste, there's no good ease-of-use argument for using just part of the fingerprint.
  2. It promotes poor security hygiene.
  3. Verifying eight hexits just isn't useful. It's hard to imagine an attacker in a position to provide a different key while not also being in a position to just generate a few billion keys hoping for that much of a hash collision.

Eight hexits was not nearly enough to make generating a hash collision cost-prohibitive.  And although Docker is serving everything over TLS, this was teaching bad security hygiene.
Copy link
Member

@thaJeztah thaJeztah left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

could you perhaps also update the debian page with the same changes? https://github.com/docker/docker.github.io/blob/master/install/linux/docker-ce/debian.md

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants