4 ms·

If it fails to decompress because the file is corrupt, the browser would more then likely keep the archive? But if someone replaces the archive with a maliciou

• k1t 7y ago
  The actual download might be hosted by 3rd party mirrors. You can compare the checksum to the one on the author's site to ensure the mirror provider didn't alter the file.
• kadoban 7y ago
  There are signature schemes that can fix that issue, and cases where it's useful anyway, like: Many linux distro isos are available from several different mirrors. Having a secure hash on the original site with the links to mirrors means I don't have to trust the mirror(s). Another case where the archive hash is useful is when there's some public key crypto involved. I can have a public key from a publisher (gotten either out-of-band or in the past) and the hash can be signed so I can verify it. These schemes would mean that an attacker would at the least need to have compromised a site for an extended period of time (if I have history with the site, the first visit it doesn't do anything extra), or in the case of out-of-band key sharing, multiple communication methods might need to be compromised for an attack to succeed. But yes, in the common case a hash next to a file link hosted on the same domain really doesn't do anything.