3 ms·
Checksums offer no security. An attacker can alter them right after altering the image. Now if the images were signed, it would be a different story...
by ReidZB 13y ago
Checksums offer no security. An attacker can alter them right after altering the image. Now if the images were signed, it would be a different story...
- dignan 13y agoJust to follow up on this, what checksums do offer is a way to verify that the file you have locally matches the remote file.
- testing12341234 13y agoChecksums do not offer this property if both the remote file and checksum are both sent unsecured. If an attacker can MitM the remote file, then they can also do the same for the checksum file.
- cma 13y agoAs long as they send the cryptographic checksum through ssl/tls, you are fine. No need to send the whole file through it.
- deleted 13y ago[deleted]
- repsilat 13y agoUnfortunately, ftp.freebsd.org doesn't seem to support https.
- douglasheriot 13y agoChecksums are also found in the PGP signed release email.