DUO - MFA

[Cantor, Scott]

On 8/4/14, 2:37 PM, "Bryan E. Wooten" <bryan.wooten at utah.edu> wrote:
>
>Today, I found this:
>
>http://central.sonatype.org/articles/2014/Aug/03/https-support-launching-n
>ow/

TLS doesn't really enter into it unless you're specifically authenticating
the certificate, and unless you're tying artifacts to specific
authenticated certificates.

I don't know that Maven checks them at all, but there's no security in
commercial TLS. With a local build against a single trusted Nexus, you
could hopefully lock the Java trust store down to just a well-known key
for that instance when running Maven.

That is the plan for the IdP builds, but we haven't gone that far yet.

>What is your opinion of jar signing and checksums as mitigating factors.

Checksums don't authenticate anything. Jar signing is the mitigation, but
Maven doesn't support checking it. Nexus can, I believe, if it's proxying.

-- Scott