3

I'd like to know whether HTTPS can be used as a secure means of software distribution.

Concretely, can I put up a file on a server making it accessible through a public HTTPS URL and be sure that it won't be infected by malware by the time it reaches the user?

If no, what other ways are there to securely distribute software?

5

Concretely, can I put up a file on a server making it accessible through a public HTTPS URL and be sure that it won't be infected by malware by the time it reaches the user?

HTTPS only secures the transport. If this is your only problem then HTTPS is sufficient.

But, HTTPS does not secure the files at the server, nor does it secure the transport to the server (unless you use HTTPS too or for similar security SSH). It does also not protect your computer so it might be possible that the binary you ship already contains malware (would not be a first).

If no, what other ways are there to securely distribute software?

A good idea is to start with security es early as possible. I.e. make sure that the build itself is fine (no malware on your machine, source code not compromised by including suspicious third party code...) and then sign the binary, see Wikipedia on Code Signing. If any changes are done to the software after the signing process the signature will be invalid.

3
  • 1
    and publish the hash of the file on the website
    – Daniel Ruf
    Dec 3 '15 at 16:21
  • @DanielRuf: distributing the hash of the file on the same site as the file itself is not a security measure but only an offer to verify that the download got not corrupted. If anybody is able to either hack the site and replace the binary or to man-in-the-middle the connection (s)he will be able to modify the displayed hash too. Dec 3 '15 at 20:08
  • Sure, but you can publish it on a remote server, on GitHub or any other third party.
    – Daniel Ruf
    Dec 3 '15 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.