4 ms·

It seems the online tool does nothing other than compute the SHA-1 hash. Given that it seems the documents that a user would want to hash for this method are li

It seems the online tool does nothing other than compute the SHA-1 hash. Given that it seems the documents that a user would want to hash for this method are likely to be sensitive, it seems prudent to suggest that users use an offline method of generating the hash.

steren 13y ago
Yes it is just a helper to compute a SHA256 of a file and generate output in hexadecimal. The "online tool" runs client side, nothing is sent to a server. You can read its sources to be sure about this.
- kzrdude 13y ago
  That would require every user to validate the sources themselves. See, I could read your code today and recommend the site to my friend as safe, but you can then change what you serve from day to day or even from user to user (So that only likely targets are served a malicious version)
  - steren 13y ago
    We should dynamically compute a hash of the source files client-side and compare it with a previous hash validated by a trusted third party and available online. If they don't match, the client displays a red warning :)
    - michaelmior 13y ago
      I don't understand this point. In any case, the point is that we may trust your site today, but it may be compromised in the future. In which case it also can't be trusted to show any sort of warning.
    - Ellipsis753 13y ago
      Good idea in theory but it doesn't really work. If someone (like you) can change the code that the client gets then they can simply remove or fake the hash checking code.
    - kzrdude 13y ago
      Sure, a firefox extension could do that.
uranuran 13y ago
Here's my exploration of asm.js and the file API for making a offline SHA256: https://rawgithub.com/kristofferkoch/web-lafs/master/test/sha256file.html https://rawgithub.com/kristofferkoch/web-lafs/master/test/sh...
- steren 13y ago
  Thanks. I am using https://code.google.com/p/crypto-js/#SHA-2 https://code.google.com/p/crypto-js/#SHA-2 but no web workers yet, this can be a problem with large files.

steren 13y ago

Yes it is just a helper to compute a SHA256 of a file and generate output in hexadecimal. The "online tool" runs client side, nothing is sent to a server. You can read its sources to be sure about this.

kzrdude 13y ago
That would require every user to validate the sources themselves. See, I could read your code today and recommend the site to my friend as safe, but you can then change what you serve from day to day or even from user to user (So that only likely targets are served a malicious version)
- steren 13y ago
  We should dynamically compute a hash of the source files client-side and compare it with a previous hash validated by a trusted third party and available online. If they don't match, the client displays a red warning :)
  - michaelmior 13y ago
    I don't understand this point. In any case, the point is that we may trust your site today, but it may be compromised in the future. In which case it also can't be trusted to show any sort of warning.
  - Ellipsis753 13y ago
    Good idea in theory but it doesn't really work. If someone (like you) can change the code that the client gets then they can simply remove or fake the hash checking code.
  - kzrdude 13y ago
    Sure, a firefox extension could do that.

uranuran 13y ago

Here's my exploration of asm.js and the file API for making a offline SHA256: https://rawgithub.com/kristofferkoch/web-lafs/master/test/sha256file.html https://rawgithub.com/kristofferkoch/web-lafs/master/test/sh...

steren 13y ago
Thanks. I am using https://code.google.com/p/crypto-js/#SHA-2 https://code.google.com/p/crypto-js/#SHA-2 but no web workers yet, this can be a problem with large files.