3 ms·
That still allows an attacker to deliver you an older binary than you previously had installed — potentially one with major vulnerabilities. Signing doesn't pr
by kuschku 9y ago
That still allows an attacker to deliver you an older binary than you previously had installed — potentially one with major vulnerabilities.
Signing doesn't prevent downgrade attacks, HTTPS does.
- userbinator 9y agoYou would also look at the version number when you check the signature...
- kuschku 9y agoThe signature is automatically verified by the system — when you open the installer, it either shows "unknown developer" or "PuTTY team" in the UAC dialog. Which is easy to verify. Do you know the version of PuTTY you have installed without checking?