Re:Why HTTPS Everywhere isn't on addons.mozilla.org
by snowwrestler on Tuesday November 25, 2014 @11:04PM
(#8661068)
> The reason you sign packages is to ensure that the file you want and the file you get are actually the same. If you have a secure connection to the trusted host of said file, you don't need to worry about that.
HTTPS provides a secure connection, in theory, but what if AMO is itself compromised? They are just a 3rd party host for the EFF's extension, after all.
HTTPS or not, the only way to check that the code you get from AMO is the same code the EFF gave AMO, is to check it against the EFF's signature.
HTTPS provides a secure connection, in theory, but what if AMO is itself compromised? They are just a 3rd party host for the EFF's extension, after all.
HTTPS or not, the only way to check that the code you get from AMO is the same code the EFF gave AMO, is to check it against the EFF's signature.