Verifying installers downloaded over HTTPS

Question

Many developers distribute software over a HTTPS connection and recommend that their users verify the integrity of the executable by comparing a hash or PGP signature. Both the executable and the hash are served over HTTPS from the same domain. What possible benefit could one achieve by verifying the executable? If an attacker has been able to replace the installer, surely they can also replace the hash displayed on the webpage, since both are served from the same domain.

I've seen this with a bunch of installers, but I'll pick Whonix as an example. They go as far as declaring downloads without verification as having "medium" security and downloads with verification as having "high" security. There is a reference link behind the claim, but the link is broken so I don't know what the explanation would have been.

Answer 1

An attacker with a Man-in-the-Middle position, able to silently intercept and modify HTTPS traffic (which is infeasible in practice), would indeed be able to serve one user a modified executable with a modified hash and a compromised GPG key.

But if one were to be truly paranoid, then they would not download the GPG key that created the signature via the same connection that they used to download the executable. Instead, you would download the executable, for example, at home, and then download the GPG key in an internet café.

As you can tell, this is not really done in practice, and ususally there is no need to do so. TLS, if configured correctly, is considered secure in practice by today's standards.

So what to do in practice?

In practice, you have several options:

• Option 1: Disregard hashes and GPG signatures and trust that the download will be fine.
• Option 2: Verify the attached checksum to make sure the download didn't have any errors. This is what I personally do with OS downloads and the likes.
• Option 3: Download the GPG key, do gpg --verify and see if everything is okay.
• Option 4: Download the executable on one machine, then move to a different location to download the GPG key. Then physically meet with the maintainer to verify the key fingerprint. Then proceed to verify the download.

As you can see, the examples become ever more complex, in order to mitigate ever more ridiculous risks. In the end, you have to choose your own level of paranoia.