2

I've seen several sites wehre they would put the hash of the downloadable file next to the file. Why do they do this ?

I understand the purpose of comparing the hash of your file with the online hash but if an attacker could change the downloading file he shouldn't have any problems for changing the site too or the hash on the site.

Doesn't make that the hash almost useless ?

Improve this question
0

3 Answers 3

Reset to default
3

You are thinking about problem the wrong way.

One reason to have the hashes close to the download is to you detect if your download has been corrupted. It's not uncommon to have a corrupt download, so having the hash will verify if you downloaded cleanly.

The other reason is that is common to a site host the files on another host, like a Content Distribution Network. In those cases, the site owner has less control about the files, so someone could tamper them, even having direct control over the main site files. This will make sure that nobody tampered the files on the remote host.

Improve this answer
1
  • It's not uncommon to provide gpg signatures in the same way.
    – Artjom B.
    Jan 27, 2016 at 13:53
3

Doesn't make that the hash almost useless ?

  1. Hashes serve integrity purposes in addition to a security purposes. Posting the hashes is a way for people to ensure their download wasn't corrupted. This used to be more of a problem than it is today, but still...
  2. Changing the contents of a file on the server is not a visible change. Changing the hash posted alongside it is a visible change. While the attacker could change the posted hash, it increases the chance of detection.
  3. Anyone who cares (e.g., OS distributions) cryptographically sign their packages in addition to hashing. Of course, signing keys have also been compromised. There's no perfect security; the perfect is the enemy of the good.

So no, hashes aren't useless. They aren't perfect, but they're one piece of the puzzle necessary to secure software distribution.

Improve this answer
2

Depends if the download and the hash are on the same server - it's not uncommon for downloads to come from CDN providers or systems like S3, which provide static file hosting, whereas the rest of the page comes from a CMS on a webserver with dynamic content. In this case, or where a file can be downloaded from an alternative source, it provides a good indicator that the file is as originally generated.

The same applies for things like Linux distributions, where Bittorrent might be used for distribution. By checking the sum, it provides reassurance that the correct file has been downloaded.

If the file and the hash are on the same server, it's less useful though - as you say, if you can change one, you can probably change the other.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .