A downloading whine

| Comments (4) | COMSEC Outstanding! Software
Can someone explain to me why when when I go to download Firefox, Xcode, or a bunch of other software for that matter, it happens over HTTP and not HTTPS? Remember, I'm about to install and run this software on my computer: if an attacker has managed to hijack my connection, they can get me to run anything they want. But nooo.... Even if you connect to the site with HTTPS, it redirects you to HTTP to download your file. There are obvious reasons to favor HTTP over HTTPS, namely performance and allowing mirrors. On the other hand, that makes the need for publication of the digest even more critical, since it sucks to have to trust the mirror.

If you're going to use mirrors, the right thing to do here is to public a digest of the file on an HTTPS-accessible page (remember: these sites already will let you access them over HTTPS, so this doesn't make the situation worse). This would let users download the file from a mirror and then check the digest against the master site. I don't see digests on either site, though. It could just be that I'm missing it, but then surely lots of others are as well.

4 Comments

HTTPS doesn't guarantee that no one has hijacked the original site.

I see a very small cross-section of attacks that HTTPS will protect against, but digests take care of almost all of those.

We definitely need more digests, and perhaps the browsers should automatically calculate the digest and display it in their download window.

Because there are so few people who care that the operational overhead of doing it right isn't worth it?

The more I think about it the more I like the browser calculating a digest.

I haven't written a Firefox extension, but surely we could come up with one that puts a digest in the download window, right? And eventually it could get put into the browser itself.

If it's easy for a downloader to get a digest, it's more likely that he will compare what he gets against what he was supposed to get.

I remember a long time ago I read some W3C draft that specified you could supply a "digest" or "checksum" or some other attribute to an <a> tag; so the browser could automatically check this. (Although you face the issue of the person corrupting the original page can just put up their own checksum.)

If only there was some way to encrypt and sign HTML content independently of the transport. Perhaps someone will be smart enough to design something like this...maybe we could call it something like SHTTP. Naaaah. It'd never work.

Leave a comment