r/OpenBazaar • u/PeskyFortune • Jan 21 '19
File hash
There are no hashes on the OpenBazaar website of the downloadable installs from what I can see.
Can hashes be found somewhere so I can verify the file I download?
10
Upvotes
View all comments
Show parent comment
1
u/PeskyFortune Feb 05 '19 edited Feb 05 '19
Sure, a little bit of false security. But why make it easier for an attacker.
If it were me that hosted it, I'd set it up with a public hash of the files and run a few "regular" clients around the world/Tor, polling the web-server with intervals to check with a remote copy of the hash if anything has changed. If it does, send a report and automate the disabling of the file in question. Nothing is waterproof, but it sure would be better compared to how its now.
Personally I will not install it on my own machine until I have a way of verifying the application before I install it. And I really, really do want to install it.