Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
2 Added link to an MSDN post backing up the assertion that the entire file must be read in order to verify the signature.
source | link
  1. When Windows verifies a file, it must compute a hash of the file, and match it against the digital signature. In order to compute the hash, Windows does need to read the entire file (see this blog.msdn.com post). Copying a file will naturally take longer than just reading it, as it require write operations, in addition to reads.

  2. If Windows did not read the entire file, it indeed could not verify it properly.

  3. When you run a small setup file that copies other data to your computer, the only signature being checked before the UAC appears is the signature of the setup itself. You are not guarantied that the other files have not been tampered with. You can only hope that the installer does it's own checks before copying the files. There has been malware discovered in the not so distant past (PlugX for example) that used legitimately signed executables to load malicious dlls.

  1. When Windows verifies a file, it must compute a hash of the file, and match it against the digital signature. In order to compute the hash, Windows does need to read the entire file. Copying a file will naturally take longer than just reading it, as it require write operations, in addition to reads.

  2. If Windows did not read the entire file, it indeed could not verify it properly.

  3. When you run a small setup file that copies other data to your computer, the only signature being checked before the UAC appears is the signature of the setup itself. You are not guarantied that the other files have not been tampered with. You can only hope that the installer does it's own checks before copying the files. There has been malware discovered in the not so distant past (PlugX for example) that used legitimately signed executables to load malicious dlls.

  1. When Windows verifies a file, it must compute a hash of the file, and match it against the digital signature. In order to compute the hash, Windows does need to read the entire file (see this blog.msdn.com post). Copying a file will naturally take longer than just reading it, as it require write operations, in addition to reads.

  2. If Windows did not read the entire file, it indeed could not verify it properly.

  3. When you run a small setup file that copies other data to your computer, the only signature being checked before the UAC appears is the signature of the setup itself. You are not guarantied that the other files have not been tampered with. You can only hope that the installer does it's own checks before copying the files. There has been malware discovered in the not so distant past (PlugX for example) that used legitimately signed executables to load malicious dlls.

1
source | link

  1. When Windows verifies a file, it must compute a hash of the file, and match it against the digital signature. In order to compute the hash, Windows does need to read the entire file. Copying a file will naturally take longer than just reading it, as it require write operations, in addition to reads.

  2. If Windows did not read the entire file, it indeed could not verify it properly.

  3. When you run a small setup file that copies other data to your computer, the only signature being checked before the UAC appears is the signature of the setup itself. You are not guarantied that the other files have not been tampered with. You can only hope that the installer does it's own checks before copying the files. There has been malware discovered in the not so distant past (PlugX for example) that used legitimately signed executables to load malicious dlls.