2 ms·

But the downloads themselves aren't -- those are served out of https://the.earth.li/~sgtatham/putty/0.68/ https://the.earth.li/~sgtatham/putty/0.68/ For later

• anderskaseorg 10y ago
  And obviously a network attacker would never think to modify the insecurely served downloads page to point to a different download URL.
  • niftich 10y ago
    This is a possibility. But downloads have been served out of "the.earth.li/~sgtatham/putty/" for years. Yes, it's owned by someone else and exploding turtles all the way down [1], but now that "the.earth.li/~sgtatham/putty/" is HTTPS, the checksums are properly authentic as attested by the same operator as the one who has supplied PuTTY downloads for years. I've mirrored the most important checksums here, another HTTPS site, so that if any of them ever differ you know to distrust the files. [1] https://news.ycombinator.com/item?id=7334269 https://news.ycombinator.com/item?id=7334269
    • tyrust 10y ago
      >I've mirrored the most important checksums here, another HTTPS site, so that if any of them ever differ you know to distrust the files. Or maybe you're a very motivated attacker.
    • h1d 10y ago
      It also accounts for who administers that domain. Usually uncommon domain doesn't sound more secure than been provided from larger known sources.
    • vacri 10y ago
      This requires custom knowledge. If an attacker swaps out the page and serves the links from some other unusual site (or even the.earht.li), who is going to notice? Only old-school people with that custom knowledge who also check the source of the download link. I find it bizarre that the server is managed by the guy who wrote dpkg (which involves GPG), yet still doesn't have https on it...