Ветка If it's through HTTPS, wouldn't a hash be useless since a compromised binary would have to come from the server, where t…

4 сообщения · 19:31–19:48

If it's through HTTPS, wouldn't a hash be useless since a compromised binary would have to come from the server, where the hash could also be changed?

19:31

B
Bug DeMobile
yes the hash should be from a trusted source possibly another than where you DL the file (if its against "evil" code) if its just to make sure that the DL was succesfull and you have 100% of the data then it doesnt really matter (this is overally pointless these days since checking if the DL was complete is/should be implemented in whatever tool you use to DL it)
19:40
J
Julia
And with HTTP, it would be even easier to fake it.
19:40
1. B
  Bug DeMobile
  with http your ISP or a proxy could on-the-fly inject code/data into your file. checking the hash would then most probably still help since it needs a lot more work to detect the hashes on the page and manipulate them aswell Some Tor relays did this in the past
  19:48