3 ms·
They appear to take a SHA1 Checksum from an unencrypted (non-HTTPS) website to verify the integrity of the download. Surely if you're worried about the integri
by pandog 13y ago
They appear to take a SHA1 Checksum from an unencrypted (non-HTTPS) website to verify the integrity of the download.
Surely if you're worried about the integrity of the file you should also be worried about the integrity of the source website also?
- croikle 13y agoYep, they're still rather vulnerable. I guess their approach would stop a dumb MitM which just replaces any .exe download. It also protects against the download server being compromised, assuming the original server is fine and your connection is clean. The best way is to check the signature, but that requires GPG in the first place (and trust on the key remains hairy). At least they could serve the site with HTTPS (GPGTools does this right).