5 ms·
Of course it does, otherwise a malicious mirror can (theoretically) work to find a collision between their malware and the legitimate file and serve you the for
by aianus 10y ago
Of course it does, otherwise a malicious mirror can (theoretically) work to find a collision between their malware and the legitimate file and serve you the former.
There's no good reason not to use a secure hash function.
- verbify 10y agoIt would be pretty impressive, as they'd need their malware to both do what they want and exactly match that hash. Not impossible, just clever.
- JshWright 10y agoIf your threat model involves an attacker who is able to achieve a hash collision while still implanting a sophisticated malware, you should probably avoid downloading software from random websites...