3 ms·
If you download an exe from a nonsecure connection. You cannot be sure the exe is the one offered by the site or one provided by a man in the middle. I know t
by PretzelFisch 8y ago
If you download an exe from a nonsecure connection. You cannot be sure the exe is the one offered by the site or one provided by a man in the middle. I know there are CRC checks but, this protection is not for user that understand that.
- archgoon 8y agoAs a PSA, CRC checks are insufficient to prevent tampering. CRC checks are designed to detect accidental corruption, not deliberate. Cryptographic hashes, provided over a secure connection (not http), are the basic minimum. Do note that even then, there have been demonstrated exploits of package managers downloading over http, where the parsers were demonstrated to be compromised. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3462 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3462 (nice summary of the above CVE https://www.securityweek.com/code-execution-vulnerability-impacts-linux-package-manager https://www.securityweek.com/code-execution-vulnerability-im...)