News for hackers. Stuff that matters.

A comment on Show HN: Hash Archive helps you verify the hashes of insecure downloads. Parent comment

Re:Show HN: Hash Archive helps you verify the hashes of inse... by btrask on Sunday June 05, 2016 @06:00PM (#11843371)
Yes, this has been discussed. It has to be done carefully so that it doesn't leak every URL you download, but if done well I think it would be useful.
[ Parent | on HN ]
Re:Show HN: Hash Archive helps you verify the hashes of inse... by ikeboy on Sunday June 05, 2016 @06:12PM (#11843415)
Double hash the url and check if it's in the database: if not, prompt the user if you want to upload the actual url.
[ Parent | on HN ]
Re:Show HN: Hash Archive helps you verify the hashes of inse... by btrask on Sunday June 05, 2016 @06:20PM (#11843447)
I believe that double-hashing is "equivalent" to single-hashing. See this issue: https://github.com/ipfs/refs-denylists-dmca/issues/2

There are some ways of doing it, depending on exactly what your threat model is, but I think it's risky in general. Right now this is just in the planning stages, but I want to have submitting URLs be a manual button click for each download, and also provide an option to use a local copy of the database (so that all lookups would be completely private).

[ Parent | on HN ]