# HTTP

I'm aware that HTTP sends plain text over the network which can be sniffed and modified if a [MITM][1] is performed.

# HTTPS

On the other hand, HTTPS sends encrypted text over the network that can neither be sniffed nor modified.

# Other?

I'm wondering if there is an in between where the traffic can be sniffed, but not modified. I was thinking the server could just sign every packet using a [CA][2].

I'm also aware of manually verifying hashes of files downloaded, but seeing as those hashes are served over a modifiable means (HTTP), it doesn't seem that this really provides any authenticity as the hash could modified to match the modified file. As @mti2935 suggested, the hash could be sent over HTTPS, but I'm looking for a preexisting protocol to handle all this.

  [1]: https://en.wikipedia.org/wiki/Man-in-the-middle_attack
  [2]: https://en.wikipedia.org/wiki/Certificate_authority