4 ms·
I think he means that the JavaScript that computes the hash can be MITM'd.
by xtacy 15y ago
I think he means that the JavaScript that computes the hash can be MITM'd.
- wccrawford 15y agoHow would it be MITM'd? It all happens on your computer. Nothing travels over the network after the page is downloaded.
- antimatter15 15y agoI think what xtacy means by MITM is that the javascript sent by the server might be MITM'd and altered to return a different value than the actual hash. But for instance, if I'm trying to SHA1 a Windows 8 iso (the kind which I imagine would be by far the most common use case - in which a cryptographically secure hash algorithm isn't even a prerequisite any checksum would do). It's not any worse than downloading the sha1sum app from any http site.
- tptacek 15y agoNo, it's worse than downloading the "sha1sum" app, because you only have to download "sha1sum" once. You can use a variety of out-of-band methods to verify the file that you can't reasonably or cost-effectively do with a website. A website is essentially "installed" every time you visit it.
- chadkeck 15y agoWell I guess I'm not so paranoid if you're worried about the JS being MITM'd :D