Linked Questions

6
votes
3answers
13k views

Why is it necessary to match the checksum of a download with another file provided by the same server? [duplicate]

Possible Duplicate: Does hashing a file from an unsigned website give a false sense of security? On many servers providing files for download, there is a file on which checksums are provided for ...
9
votes
4answers
1k views

What's the point of providing file checksums for verifying downloads? [duplicate]

Many projects offering binaries, also offer hashes (e.g. SHA256) of those binaries, wither as .ASC files, or directly on the web page near the binary. This isn't to protect against network-caused ...
4
votes
3answers
2k views

Why verify a file / firmware downloaded online against a checksum? [duplicate]

When ever there is a file / firmware to download online and they provide a checksum to check the file against, i always confirm the check sum of the downloaded file matches the checksum posted online. ...
3
votes
1answer
212 views

Is there any purpose for providing checksums on a non-HTTPS location? [duplicate]

When you download a file, sometimes the website owner puts an MD5, SHA1, SHA256 or similar hash/checksum of the file right next to it; either on the page where you can download it, or as a separate ...
1
vote
1answer
124 views

Why do some websites have their hashes on the same area as the download link? [duplicate]

Some sites allow us to use hashes to make sure that the file we download is what it should be and that it is not tampered with. Some sites may have their hashes on a different domain probably on a ...
1
vote
1answer
58 views

If site provides MD5 to check file, can't the comparison string also not be modified? [duplicate]

I am new to this so please bear with me. I was downloading a VM image and I was told to check the MD5. Naturally, I did but wondered, If a hacker would change the file to be downloaded from the ...
0
votes
0answers
44 views

Why developers put the installer/executable and the file checksum on the same server? [duplicate]

On https://exiftool.org/ , there is a link to https://exiftool.org/exiftool-12.01.zip and https://exiftool.org/checksums.txt . Both the ZIP archive and the checksum hash are hosted on the same machine....
0
votes
1answer
43 views

How can hash keys of downloadable binaries be useful if a website has been compromised? [duplicate]

Sometimes a website that has some binaries to download, also presents their hash keys, so that a user can verify the integrity of the binary. I suppose this is mainly for security reasons, not to ...
12
votes
9answers
3k views

Where to download OpenBSD release ISO's over HTTPS?

OpenBSD claims to be highly secure. So why doesn't it allow downloading the release iso's over HTTPS? Or I'm missing something? Can someone please explain this to me?
18
votes
6answers
16k views

What reputable site should I download Putty from?

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code. If you needed to download Putty for a high security Windows ...
7
votes
4answers
9k views

when people say a file has a checked md5 hash, what exactly does that mean?

ok I was just reading this site: http://www.zdnet.com/blog/bott/stay-safe-online-5-secrets-every-pc-and-mac-owner-should-know/3542?pg=4&tag=mantle_skin;content and thought of something I always ...
10
votes
3answers
1k views

Downloaded file checksums

More than often next to the download button of a file there is a variety of checksums. When I download a file what security risks am I exposed to if I don't check for its integrity?
8
votes
3answers
638 views

How safe are copies of Firefox that are on various Mozilla mirror sites?

If I end up downloading a .dmg or .exe (depending on OS) installer from some mirror site, how can I be sure that a virus or trojan or spyware has not been added? I don't see any mechanism for ...
9
votes
4answers
539 views

Why would distributing via Google Play be more secure than distributing APKs?

Why do so many Android developers use Google Play to distribute apps instead of (or in addition to) simply putting the APK on their secure website along with a checksum or signature of it?
1
vote
2answers
12k views

How hash ensure integrity of data? [duplicate]

I understand what a hash is, basically we calculate a hash and append it to the message and send it to the receiver. If someone alters the message, the receiver will know because there would be a ...

15 30 50 per page