<p>Nothing. It is mostly only useful for checking data integrity, not detecting malicious modification (unless you know someone trustworthy that signed the hash). SSL has the same problems though, because public keys can be altered too of course.</p>

<p>There are multiple solutions to this problem, although none is perfect.</p>

<ul>
<li>Trusting some central authority to decide who is trustworthy and who is not (i.e. <a href="http://en.wikipedia.org/wiki/Certificate_authority" rel="nofollow">Certificate authority</a>). This approach has been shown multiple times to be dangerous, see <a href="http://en.wikipedia.org/wiki/DigiNotar" rel="nofollow">DigiNotar</a> for example. </li>
<li>Building a <a href="http://en.wikipedia.org/wiki/Web_of_trust" rel="nofollow">web-of-trust</a>, the method PGP (and later GPG) implemented.</li>
<li>Circumventing the normal network with private lines and routing (the military approach), or wait for <a href="http://en.wikipedia.org/wiki/Quantum_cryptography" rel="nofollow">quantum encryption</a> to become available.</li>
</ul>

CC BY-SA 3.0
2014-04-11T08:02:38.363Z
2014-04-11T08:02:38.363Z
Jori
<p>Some <a href="http://www.nxtcrypto.org/nxt-change-log/nxt-0813-change-log" rel="nofollow">websites</a> publish sha256 to check authenticity of downloaded file.</p>

<p>I suppose this is to protect against man-in-the-middle attack - that my file was not altered during download.</p>

<p>What prevents man-in-the-middle from altering web traffic and fix hash code that I see to match malicious downloaded file ?</p>

<p>Those <a href="https://www.nxtcrypto.org/nxt-change-log/nxt-0813-change-log" rel="nofollow">sites</a> often do not provide SSL, so capturing and fixing HTTP traffic is easy, all it takes is to work with my ISP or some backbone router.</p>

<p>There are even <a href="http://hash.online-convert.com/sha256-generator" rel="nofollow">sites</a> that allow to calculate sha256 by uploading file over unsafe HTTP with no SSL - ridiculous isn't it ?</p>

<p>Not only I have to trust that <a href="http://hash.online-convert.com/sha256-generator" rel="nofollow">this website</a> does not work for government, I also have to trust my ISP by connecting without SSL.</p>

CC BY-SA 3.0
2014-04-11T10:15:46.160Z
This question appears to be off-topic because it is not about bitcoin or cryptocurrencies but about general security and verification. It would probably be more at home on another StackExchange sub-site.
dchapes
CC BY-SA 3.0
2014-04-12T03:15:17.887Z
I somewhat agree, but I planned to ask it together with this question: http://bitcoin.stackexchange.com/questions/24489/using-blockchain-to-publish-downloadable-software-verification-codes and then decided to take them apart.
CoinsKillTheFed
CC BY-SA 3.0
2014-04-12T03:41:23.763Z
Agree - though nice, this question pertains more to another S.E. site
Joe Pineda
CC BY-SA 3.0
2014-04-13T02:06:06.023Z
Which site ? I don't know how or do not have permission to move it. I guess somebody with higher rating could move it for me.
CoinsKillTheFed
<verification><sha256><safety><synchronization><ssl>
What is the point of comparing sha256 of downloaded file with published on the same website code?
CoinsKillTheFed
# What is the point of comparing sha256 of downloaded file with published on the same website code?

(Asked by: username_0 on 2014-04-11)

Some [websites](http://www.nxtcrypto.org/nxt-change-log/nxt-0813-change-log) publish sha256 to check authenticity of downloaded file.

I suppose this is to protect against man-in-the-middle attack - that my file was not altered during download.

What prevents man-in-the-middle from altering web traffic and fix hash code that I see to match malicious downloaded file ?

Those [sites](https://www.nxtcrypto.org/nxt-change-log/nxt-0813-change-log) often do not provide SSL, so capturing and fixing HTTP traffic is easy, all it takes is to work with my ISP or some backbone router.

There are even [sites](http://hash.online-convert.com/sha256-generator) that allow to calculate sha256 by uploading file over unsafe HTTP with no SSL - ridiculous isn't it ?

Not only I have to trust that [this website](http://hash.online-convert.com/sha256-generator) does not work for government, I also have to trust my ISP by connecting without SSL.

**Tags:** verification, sha256, safety, synchronization, ssl

> **Comments:**
> **username_1**: This question appears to be off-topic because it is not about bitcoin or cryptocurrencies but about general security and verification. It would probably be more at home on another StackExchange sub-site.  
> **username_0**: I somewhat agree, but I planned to ask it together with this question: http://bitcoin.stackexchange.com/questions/24489/using-blockchain-to-publish-downloadable-software-verification-codes and then decided to take them apart.  
> **username_2**: Agree - though nice, this question pertains more to another S.E. site  
> **username_0**: Which site ? I don't know how or do not have permission to move it. I guess somebody with higher rating could move it for me.  

---

## 1 answers

### Answer by username_3 on 2014-04-11. Score: 3 | Accepted answer

Nothing. It is mostly only useful for checking data integrity, not detecting malicious modification (unless you know someone trustworthy that signed the hash). SSL has the same problems though, because public keys can be altered too of course.

There are multiple solutions to this problem, although none is perfect.

* Trusting some central authority to decide who is trustworthy and who is not (i.e. [Certificate authority](http://en.wikipedia.org/wiki/Certificate_authority)). This approach has been shown multiple times to be dangerous, see [DigiNotar](http://en.wikipedia.org/wiki/DigiNotar) for example.
* Building a [web-of-trust](http://en.wikipedia.org/wiki/Web_of_trust), the method PGP (and later GPG) implemented.
* Circumventing the normal network with private lines and routing (the military approach), or wait for [quantum encryption](http://en.wikipedia.org/wiki/Quantum_cryptography) to become available.


---

