5

I've tried downloading the setup files for a standalone offline installation version several times in rapid succession. Each next file has an identical size but a different hash. Why is that?

Do they embed some sort of a user identifier into each next download?

The same happens for both EXE and MSI standalone installers.

P.S. I've also noticed that the files have a digital signature with a past date (6 days ago). That means they are generating files on the fly on a machine that is simulated to have a past date. In my book this qualifies as fraud.

Improve this question
6
  • How are you calculating hashes? What about other browsers? Where are you downloading from?
    – gronostaj
    Commented Sep 5, 2014 at 9:05
  • Different browsers (IE, Firefox), downloading directly from google.com, using a popular tool md5deep to calculate SHA1 hashes. There are never two identical files.
    – guest
    Commented Sep 5, 2014 at 9:15
  • 3
    I've found an installer I have downloaded on August 26 and it has a signature from June 2. We don't know if they are generating these files on the fly, maybe they have a bunch of files and are serving them sequentially. That would explain signatures from the past.
    – gronostaj
    Commented Sep 5, 2014 at 9:56
  • 1
    It wouldn't surprise me at all to find [licenced] software that might include some dynamic payload -- such as for licencing, or for anti-piracy. A 6-day age on in the signature might indicate the pre-signing of a number of files, as a way of keeping a low-water level on the number of available downloads that are ready-to-go. I wouldn't say that would be a fraudulant action, though I would perhaps hope [wishfully] that they have some manually signed package before unsigning, modifying and re-signing automatically. Its something of a requirement for software installers to be signed these days.
    – Cameron Kerr
    Commented Sep 5, 2014 at 10:45
  • 2
    What? Fraud of what exactly?
    – Ramhound
    Commented Sep 5, 2014 at 11:33

1 Answer 1

Reset to default
3

I can not reproduce your claim. Can you provide more details, especially steps on how to reproduce it on my end?

I went to the link to download Chrome Standalone.

I compared three installers I downloaded for the one user version:

Chrome Standalone One User

All three installers were bit-for-bit exact copies of each other

C:\>fc chromestandalonesetup.exe "chromestandalonesetup (1).exe"
Comparing files ChromeStandaloneSetup.exe and CHROMESTANDALONESETUP (1).EXE
FC: no differences encountered

C:\>fc "chromestandalonesetup (1).exe" "chromestandalonesetup (2).exe"
Comparing files ChromeStandaloneSetup (1).exe and CHROMESTANDALONESETUP (2).EXE
FC: no differences encountered
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .