4 ms·

Assuming you trust your torrent client to verify file integrity/sums correctly, you'd probably still want to compare the author's checksum to the one on the tor

by zdkl 10y ago

Assuming you trust your torrent client to verify file integrity/sums correctly, you'd probably still want to compare the author's checksum to the one on the torrent providers side at least

minitech 10y ago
What do you mean “on the torrent provider’s side”? They’re all on the same server, and the magnet link and hash digests are even part of the same page.
- zdkl 10y ago
  You're assuming the server is secure
  - minitech 10y ago
    Yes. If you assume the server isn’t secure, there’s no point in any of the other things except the PGP signature, the keys corresponding to which I wouldn’t be able to get anywhere without making some other assumption of security.
  - Etzos 10y ago
    If the source server is compromised then nothing can help you. All source links can be changed to something malicious and all verification methods can be different to match the ones of the bad file. If the source server is compromised there is no way to accurately verify the file's source (unless using verified PGP signatures which you've already vetted).
    - zdkl 10y ago
      That's my point. Why go to the trouble of securing the transport layer if you're both NOT using PGP AND assuming with no proof that the server isn't compromised? I mean sure "security all the things" pays my ramen but at some point youve gotta wonder if you wouldn't be better off securing a trusted signature transmission method and comparing your insecure downloads to those provably correct signatures. I'm not complaining, in the end clients assuming the server is uncompromised "because otherwise we'd be boned" and relying on transport security on top of that has secured me most of my work this past year... :)
      - minitech 10y ago
        > Why go to the trouble of securing the transport layer if you're both NOT using PGP AND assuming with no proof that the server isn't compromised? To guard against MITMs as well as DNS spoofing to an extent.

by zdkl 10y ago

Assuming you trust your torrent client to verify file integrity/sums correctly, you'd probably still want to compare the author's checksum to the one on the torrent providers side at least

minitech 10y ago

What do you mean “on the torrent provider’s side”? They’re all on the same server, and the magnet link and hash digests are even part of the same page.

zdkl 10y ago
You're assuming the server is secure
- minitech 10y ago
  Yes. If you assume the server isn’t secure, there’s no point in any of the other things except the PGP signature, the keys corresponding to which I wouldn’t be able to get anywhere without making some other assumption of security.
- Etzos 10y ago
  If the source server is compromised then nothing can help you. All source links can be changed to something malicious and all verification methods can be different to match the ones of the bad file. If the source server is compromised there is no way to accurately verify the file's source (unless using verified PGP signatures which you've already vetted).
  - zdkl 10y ago
    That's my point. Why go to the trouble of securing the transport layer if you're both NOT using PGP AND assuming with no proof that the server isn't compromised? I mean sure "security all the things" pays my ramen but at some point youve gotta wonder if you wouldn't be better off securing a trusted signature transmission method and comparing your insecure downloads to those provably correct signatures. I'm not complaining, in the end clients assuming the server is uncompromised "because otherwise we'd be boned" and relying on transport security on top of that has secured me most of my work this past year... :)
    - minitech 10y ago
      > Why go to the trouble of securing the transport layer if you're both NOT using PGP AND assuming with no proof that the server isn't compromised? To guard against MITMs as well as DNS spoofing to an extent.