Is adding apt keys using wget secure?

Question

Many (I would even say most) projects that have Debian repo give instructions like this (https://www.dotdeb.org/instructions/):

3. Fetch and install the GnuPG key
wget http://www.dotdeb.org/dotdeb.gpg
sudo apt-key add dotdeb.gpg

Isn't this insecure? My reasoning is:

• the key is not downloaded over HTTPS so it can be altered on the way
• attacker could forge repo and sign it with the altered key
• altered package will be installed

Answer 1

Yes, it is insecure to use http instead of https because it can be attacked by man-in-the-middle, by DNS spoofing or in other ways, so you get the wrong key and also wrong software. Checking the fingerprint of the key would not help either unless you got the fingerprint by https.

And while it would be better to use https, it would not mean that TLS provides full security. All it provides is security of the transport which means:

• You need still to trust the site itself. How to you know that this site does not intent to serve malware to you? Where did you get the information about the site from? How trustworthy was the person/site providing this information and was the transport protected by https?
• You need to trust the security of the site. It might be hacked and serve wrong key and software.
• You need to trust the author or distributor of the software that it does not contain any bugs or even backdoors.
• ...

Given that hacking a site or setting up a similar looking phishing site (which might use TLS too) is often easier than mounting a man-in-the-middle attack you should ask yourself if using TLS would be enough to provide the level of security you need.