3 ms·
md5 only ensure data integrity from the download itself if the data has been tampered with, it ensures nothing. the md5 can be changed or even, the file can be
by zobzu 15y ago
md5 only ensure data integrity from the download itself
if the data has been tampered with, it ensures nothing. the md5 can be changed or even, the file can be made to match the md5 (its broken)
gpg/pgp is a much better alternative as you can't create the signature either without having the original key (its not bullet proof as one could store the key in unsafe locations or be hacked of course, but its much better)
- mike-cardwell 15y agoSigning using PGP would be good, but it wouldn't prevent somebody using a replay attack to cause the browser to download an old vulnerable version of an application instead of a new patched version.
- Tharkun 15y agoSigning moves the problem elsewhere. The problem then becomes the key exchange. How do I, as a first time downloader, know that the key listed on the website is the correct one? It's the same problem SSL has, sure, there's a key, and your browser trusts it, but how do I know that this key can really be trusted?