Comment on Handbrake malware analysisparentComments−perfectlyfin9yWell, if they can compromise the host website, they can change the published SHA hash.Similar thing happened to TransmissionBT. For a while, their legit website was serving a hacked binary.Pinned long-term public keys are the only way to verify this stuff. Even that isn't fool-proof if the rogues get commit access.−pbhjpbhj9yIs there such a thing as a co-hash where an application can verify the hash and the hash can verify the application?It might work in the way that generating a hash collision for an arbitrary string works??Probably wouldn't help in these situations, just curious.
Comments
Well, if they can compromise the host website, they can change the published SHA hash.
Similar thing happened to TransmissionBT. For a while, their legit website was serving a hacked binary.
Pinned long-term public keys are the only way to verify this stuff. Even that isn't fool-proof if the rogues get commit access.
Is there such a thing as a co-hash where an application can verify the hash and the hash can verify the application?
It might work in the way that generating a hash collision for an arbitrary string works??
Probably wouldn't help in these situations, just curious.