News for hackers. Stuff that matters.
Re:A better zip bomb by OrgNet on Thursday July 04, 2019 @09:35AM (#20354479)
If it fails to decompress because the file is corrupt, the browser would more then likely keep the archive?

But if someone replaces the archive with a malicious file that decompress normally, he will also probably change the listed checksum on the download page....

Re:A better zip bomb by kadoban on Thursday July 04, 2019 @11:08AM (#20355223)
There are signature schemes that can fix that issue, and cases where it's useful anyway, like:

Many linux distro isos are available from several different mirrors. Having a secure hash on the original site with the links to mirrors means I don't have to trust the mirror(s).

Another case where the archive hash is useful is when there's some public key crypto involved. I can have a public key from a publisher (gotten either out-of-band or in the past) and the hash can be signed so I can verify it. These schemes would mean that an attacker would at the least need to have compromised a site for an extended period of time (if I have history with the site, the first visit it doesn't do anything extra), or in the case of out-of-band key sharing, multiple communication methods might need to be compromised for an attack to succeed.

But yes, in the common case a hash next to a file link hosted on the same domain really doesn't do anything.

Re:A better zip bomb by k1t on Thursday July 04, 2019 @11:00AM (#20355152)
The actual download might be hosted by 3rd party mirrors.

You can compare the checksum to the one on the author's site to ensure the mirror provider didn't alter the file.