Firefox and Thunderbird Switch to New GPG Signing Key After Key Leak
Updated GPG Key for Signing Firefox and Thunderbird Releases
Mozilla has rotated the GPG signing key used for Firefox and Thunderbird artifacts after an unencrypted copy of the previous subkey was accidentally committed to a private GitHub repository. An audit found no evidence of unauthorized access, but the old key has been revoked. Most users need no action, but those who manually verify signatures or use RPM packages on certain distributions must update their keyring. The new key's fingerprint is 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3.
Our review of available audit records found no evidence that the key was accessed by an unauthorized party while it was present in the repository.
- noman-land
If the signing subkey was committed, that implies developers have it as a file on their system which I find surprising if true. They should be using hardware like a Yubikey or something. Especially for something this important.
- iamnothere
I’m surprised that the signing key lives on a non-airgapped system. A sophisticated attacker won’t be leaving any traces.
- angry_octet
It is insane that this key is not kept in a HSM.
It would be good if there way a way to attest that a key was generated on and bound to a specific HSM.