If a Hacker can edit download link, they can edit your SHA256 hash

Posted by hellbanner on Wednesday December 20, 2017 @10:01AM
from the self-post dept.

Why do websites list SHA256 hashes next to their download links? If 1 is compromised, the other could be too?

( 2 comments | 2 points | on HN )

Re:If a Hacker can edit download link, they can edit your SH... by infosecrf on Wednesday December 20, 2017 @10:20AM (#15970255)

You could always check the SHA256 from a separate device on separate network, ie your smartphone.

[ Parent | on HN ]

Re:If a Hacker can edit download link, they can edit your SH... by czbond on Wednesday December 20, 2017 @10:29AM (#15970361)

Original poster is suggesting that if one can change the downloaded file on the source location, then the same person can update the SHA256 string used to "guarantee authenticity". They're not suggesting a MTM style attack where one changes the string mid flight.

[ Parent | on HN ]