4 ms·
Well, if they can compromise the host website, they can change the published SHA hash. Similar thing happened to TransmissionBT. For a while, their legit webs
by perfectlyfin 9y ago
Well, if they can compromise the host website, they can change the published SHA hash.
Similar thing happened to TransmissionBT. For a while, their legit website was serving a hacked binary.
Pinned long-term public keys are the only way to verify this stuff. Even that isn't fool-proof if the rogues get commit access.
- pbhjpbhj 9y agoIs there such a thing as a co-hash where an application can verify the hash and the hash can verify the application? It might work in the way that generating a hash collision for an arbitrary string works?? Probably wouldn't help in these situations, just curious.