4 ms·
Yes it is just a helper to compute a SHA256 of a file and generate output in hexadecimal. The "online tool" runs client side, nothing is sent to a server. You c
by steren 13y ago
Yes it is just a helper to compute a SHA256 of a file and generate output in hexadecimal. The "online tool" runs client side, nothing is sent to a server. You can read its sources to be sure about this.
- kzrdude 13y agoThat would require every user to validate the sources themselves. See, I could read your code today and recommend the site to my friend as safe, but you can then change what you serve from day to day or even from user to user (So that only likely targets are served a malicious version)
- steren 13y agoWe should dynamically compute a hash of the source files client-side and compare it with a previous hash validated by a trusted third party and available online. If they don't match, the client displays a red warning :)
- michaelmior 13y agoI don't understand this point. In any case, the point is that we may trust your site today, but it may be compromised in the future. In which case it also can't be trusted to show any sort of warning.
- Ellipsis753 13y agoGood idea in theory but it doesn't really work. If someone (like you) can change the code that the client gets then they can simply remove or fake the hash checking code.
- kzrdude 13y agoSure, a firefox extension could do that.