Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I thought the point of distributing md5 checksums was so the end user could verify the integrity of the download.

If a high traffic site points me to a mirror site for download, why would I want to verify my download against a checksum that is provided on the mirror?

If someone were going to tamper with binaries on the mirror site, couldn't they also tamper with the checksums? Shouldn't the authoritative site give me the checksum before I download from a mirror so I can check against the main source?

share|improve this question
    
If I can't find a proper checksum on an official site, I'll ask somebody who already has it to grab the hash for me :P –  Phoshi Sep 22 '09 at 14:47
    
Wait, you have friends that understand what a checksum is? My friends would just look at me funny and then ask if I could make their PC run fast again after having downloaded a World of Warcraft trojan. –  Joe Holloway Sep 23 '09 at 14:15

4 Answers 4

up vote 4 down vote accepted

You are right in your expectation.
Check this example at Apache.

And this Ubuntu md5sum reference.

In terms of security, cryptographic hashes such as MD5 allow for authentication of data obtained from insecure mirrors.
The MD5 hash must be signed or come from a secure source (an HTTPS page) of an organization you trust.

share|improve this answer

well, it would at least give you confidence that your copy is exactly the same as on the mirror.

you are right, that such information is kind of useless if the main source does not provide such checksum

share|improve this answer

Usually, ethical mirrors doesn't want to be interpreted as "spoof" ones. They want to be mirrors because of visibility among other advantages.

They show checksums as the authorative source do to give them some sort of credibility: "hey, we recommend you to check your checksums as the official website says!".

I believe this is the mirror's POV. As a user, I usually check with both sources.

share|improve this answer

Well, you can check if the download completed successfully - checksums arn't just a defense against malicious tampering- they also help verify if a file was completely and correctly downloaded

share|improve this answer
    
I always thought it would be nice if Firefox or other browsers would compute a checksum for you. –  Joe Holloway Sep 23 '09 at 14:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.