Proton.B: What this Mac malware does

Re:Proton.B: What this Mac malware does by nerdponx on Saturday May 13, 2017 @08:19PM (#14333623)

It's a shame that it isnt easier to check for the correct hash on downloaded software. I know it's a one liner in the terminal, but that scares prople.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by yoodenvranx on Saturday May 13, 2017 @08:25PM (#14333641)

In KDE / Dolphin you can right click on a file, select 'properties' and then there is a tab for different checksums.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by ReverseCold on Saturday May 13, 2017 @08:54PM (#14333717)

We need a right click > verify, then user pastes in the hash. It could also be added to the browser.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by kalleboo on Sunday May 14, 2017 @02:23AM (#14334521)

A hash property on the <a> tag would be spiffy

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by nerdponx on Sunday May 14, 2017 @11:08AM (#14335902)

Apparently there is, sorta: https://news.ycombinator.com/item?id=14335840

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by fulafel on Sunday May 14, 2017 @10:49AM (#14335840)

This is a HTML feature now, it's called sub-resource integrity. So you just put the hash inside a new element called "integrity" when you refer to external resources. Like so: <a href="..." integrity="...">

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by fulafel on Monday May 15, 2017 @01:18AM (#14339327)

Correcting myself: looks like the SRI spec hasn't included the <a> element in the list of supported elements, though it has a mention that it might be supported in a future version :(

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by nerdponx on Sunday May 14, 2017 @11:08AM (#14335900)

How does the browser know what hash algo to use?

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by CharlesW on Sunday May 14, 2017 @11:22AM (#14335952)

https://hacks.mozilla.org/2015/09/subresource-integrity-in-f...

"As you may have noticed, the integrity attribute does not just include the hash value. It also contains the digest name. The syntax for the integrity attribute allows multiple tokens of this name-value format. This allows site owners to specify hashes of different strengths as well as the values of multiple scripts that may be behind a URL. This is useful for browser sniffing or content negotiation."

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by acangiano on Sunday May 14, 2017 @07:43AM (#14335215)

Browsers could show a checksum when hovering on a downloaded file.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by nerdponx on Sunday May 14, 2017 @09:22AM (#14335509)

This is a brilliant idea! Does Firefox accept feature proposals if they're fleshed out? My friend is an aspiring UX designer looking to build a portfolio, and I can write crude sample code.

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by MohammadLee on Monday May 15, 2017 @02:19AM (#14339517)

Not so sure that's a good idea. This would prevent users to programmatically compare hashes, and it would be hard to display one next to the other to facilitate comparison. Keep in mind that it is relatively easy to create a file that matches the first and/or last N chars of a hash. And who checks the center of the hash? No, we have to have the browser compare the full hash and give a simple green light to the user. I don't have a proposition in terms of UX but it should be studied (should have been 15 years ago actually)

[ Parent | on HN ]

Re:Proton.B: What this Mac malware does by nerdponx on Monday May 15, 2017 @02:42AM (#14339627)

I was thinking the same thing, actually. I made a UX mockup this morning that I feel good about and was able to explain to my parents over brunch. I'll see if my friend wants to work on it.

[ Parent | on HN ]