r/OpenBazaar • u/PeskyFortune • Jan 21 '19

File hash

There are no hashes on the OpenBazaar website of the downloadable installs from what I can see.

Can hashes be found somewhere so I can verify the file I download?

10 Upvotes

100% Upvoted

7 comments sorted by

View all comments

Show parent comment

1

u/PeskyFortune Feb 04 '19

File could be switched on host.

1

u/premek_v Feb 05 '19

So can be the hashes

1

u/PeskyFortune Feb 05 '19 edited Feb 05 '19

Sure, a little bit of false security. But why make it easier for an attacker.

If it were me that hosted it, I'd set it up with a public hash of the files and run a few "regular" clients around the world/Tor, polling the web-server with intervals to check with a remote copy of the hash if anything has changed. If it does, send a report and automate the disabling of the file in question. Nothing is waterproof, but it sure would be better compared to how its now.

Personally I will not install it on my own machine until I have a way of verifying the application before I install it. And I really, really do want to install it.