Hacker News new | past | comments | ask | show | jobs | submit login

> they have signed checksums with the releases

Which might be OK for making sure the download isn't corrupted, but are useless for defending against an attacker, since the checksums themselves are hosted on a non-HTTPS site.




You're supposed to check the signature with the key you got "out of band". That means good security practice. Even if you get the key from a SSL/TLS enabled site, you can't guarantee it's the right one, CAs can be compromised. The checksum is to let you check if the download is corrupted and the signature is to check against the key you already have. Other forms of checking are just false sense of security.


Of course. I somehow missed the signed part, and now I feel stupid.



Um. You can't forge signed checksums unless you have their private key...


An attacker wouldn't MITM your download, they would take control over your mirror and serve bad copies. Hence the signatures.

SSL secured downloads would be pretty much snake oil for ensuring file integrity end-to-end. You will find the same practice pretty much everywhere among the larger projects.




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: