3 ms·
There's also the bootstrapping problem. Let's say you want to get the latest browser for your phone/PC - how do you download it with your default browser? Even
by edent 11y ago
There's also the bootstrapping problem. Let's say you want to get the latest browser for your phone/PC - how do you download it with your default browser?
Even if Firefox had a plain http site for legacy downloads - how could you trust the executable?
- MichaelApproved 11y agoTechnically, you could check the hash, no? Of course, you'd need a reliable source to give you the hash, so you could make sure you weren't given a fake hash of the fake download. So, you'd lookup the hash on a secure computer and then test the download after you insecurely downloaded it. Of course, this is more than a general consumer would know or care to bother with.
- tokenizerrr 11y agoAnd then you also need a reliable source for your hashing tool, since I don't think Windows XP (which is the most problematic) ships one.
- jenscow 11y agoAuthenticode?