I didn't understand which hashes you are talking about. Do installs usually provide a checksum or? I have not found any that do, or maybe I just ignore it.
The hashes of downloaded files, computed locally. E.g. with 'sha1sum' command or Microsoft's 'fciv'.
Suppose I download Putty and am unsure of whether it's the real thing or whether it's a Trojan, e.g. due to someone having hacked my router. I compute the hash of the file and google it: http://lmgtfy.com/?q=44ac2504a02af84ee142adaa3ea70b868185906... . I find many sites saying that's putty.exe. If I didn't, I'd be very suspicious.
googling the hash for mentions of the expected downloaded file is a pretty clever trick!
Re:How I Hacked a Router
by frozenport on Sunday April 06, 2014 @05:59AM
(#7540451)
Sounds extremely involved.
Which is why I'm always wary of installing unsigned software. In such cases I try to check some hashes some way. Obviously if the download page lists them I check against those, but in most cases it's insufficient because that page is not HTTPS. So I always help myself with google, both by googling the filename to find some pages listing a hash, and by googling my own hash (note that Google is accessed with HTTPS).