| |||||||||||||
Google Summer of Code: Mozilla ProjectsGoogle Summer of Code: Mozilla ProjectsPosted Aug 23, 2007 14:46 UTC (Thu) by jengelh (subscriber, #33263)Parent article: Google Summer of Code: Mozilla Projects
>Edward Lee's "Link Fingerprints" (mentored by Gervase Markham)
Perhaps the checksum should be sent along as a HTTP Response Header, though of course sourced from a static file, so as to not make Apache recalculate it every time.
(Log in to post comments)
Google Summer of Code: Mozilla Projects Posted Aug 23, 2007 15:12 UTC (Thu) by xav (guest, #18536) [Link] I doubt sending the md5 alongside the file will make it really secure incase of trojaned file. A non-stupid cracker would modify the md5 as well a the file (or, this would be done automatically if computed on-the-fly by apache). The advantage of md5 embedded in the webpage is that modifying the ISO and modifying the HTML accordingly is hard.
Google Summer of Code: Mozilla Projects Posted Sep 28, 2007 13:40 UTC (Fri) by swiftone (guest, #17420) [Link] I doubt sending the md5 alongside the file will make it really secure in case of trojaned file.Correct. This would be of value when the source of the link is not the same as the source of the file. LWN, for example, could post links to packages on ibiblio. On download, the files from one source (ibiblio) would be checked to match the hash from another (LWN). At that point the system is as trusted as the source of the link, which can have errors, but may be more secure than the current system (where the hash is rarely verified).
Google Summer of Code: Mozilla Projects Posted Aug 28, 2007 9:40 UTC (Tue) by Wummel (subscriber, #7591) [Link] > Perhaps the checksum should be sent along as a HTTP Response Header,There is the ETag HTTP header defined. Though it seems the Etag value only gets used for cache validation, and not for content verification.
|
|||||||||||||