File Hashes for Far Downloads

nrcuster@gmailcom · Post by **nrcuster@gmailcom** » Fri 11 Mar, 2022 17:03

I normally like to have a file hash using one of the four more popular algorithms (MD5, SHA-1, SHA256, or SHA512) for anything I download from an open source forum before installing it on my PC. I don't see a place to obtain these for the FAR Manager downloads page.

Can you please publish these on the download page or tell me where I can obtain them on the FAR Manager site?

Post by **HaRT** » Fri 11 Mar, 2022 18:43

nrcuster@gmailcom, imagine you have these hashes. What kind of attack will they protect you against? Or what other purpose should they serve?

nrcuster@gmailcom · Post by **nrcuster@gmailcom** » Thu 17 Mar, 2022 20:34

Generally, it provides the downloader the assurance the file they have downloaded has not been tampered with since it was hosted for downloading. Hashing has a large number of applications in cybersecurity, centering around the ability to verify that data is legitimate. With a secure hashing algorithm, one can verify that a downloaded file matched what was intended. In fact, many projects provide hashes alongside their downloads. This provides some peace of mind that a file is authentic and has not been altered in transmission.

In addition, some online services provide the ability to look up whether a file is known to be malicious based on file hash. Rather than uploading the entire file for the service to analyze, one can just provide the hash, since it uniquely identifies the data in the file. Often, vendors will provide hashes with downloads of firmware or other critical files. This can provide an extra level of security Isafety when downloading files and help
to prevent watering hole attacks. Additional safety measures are never a bad thing, especially when it comes to downloading files, even from trusted sources.

Good luck with your project. I'll not be installing.

Post by **HaRT** » Thu 17 Mar, 2022 22:34

nrcuster@gmailcom, what you write is all well-known but you're missing the point: if someone was able to tamper with the file you're going to download from the site, they could have tampered with the web page listing the hashes too, so you get only an illusion of increased security. What really gives more security for downloads is a valid digital signature (backed by publisher's verifiably correct certificate), and some projects do publish these, but it's not that common (yet).

If you are concerned with the download being modified by a MITM (man in the middle), this is addressed by TLS (in particular, by downloading via HTTPS rather than HTTP).

As for the the online malware scans (e.g. virustotal.com), such services are usually capable of checking content by its URL, so you don't need to upload anything.

nrcuster@gmailcom wrote: ↑Thu 17 Mar, 2022 20:34 Good luck with your project. I'll not be installing.

Good luck with your illusions and wishful thinking.

Grom PE · Post by **Grom PE** » Fri 18 Mar, 2022 11:21

The download webpage (farmanager.com/download.php) has the same domain and server as the files you download from it, so hashes don't add extra security.

If the download location was different, then hashes would help in removing the question of trust for that different download location.

Post by **pepak** » Fri 18 Mar, 2022 16:19

Two notes:

1) There's no need to be confrontational. On either side.

2) I can see one benefit of the hashes, in particular for the rather long-term stable releases - if the same hash appeared on both the FAR website and a third-party download server, it would significantly increase the probability that both host a valid file. Could it still be substituted with a fake one? Sure. But it'd still be a little better than what we have now.

buniak_a_h · Post by **buniak_a_h** » Fri 18 Mar, 2022 17:47

Post by **Yegor** » Fri 18 Mar, 2022 17:59

pepak wrote: ↑Fri 18 Mar, 2022 16:19 2) I can see one benefit of the hashes, in particular for the rather long-term stable releases - if the same hash appeared on both the FAR website and a third-party download server, it would significantly increase the probability that both host a valid file. Could it still be substituted with a fake one? Sure. But it'd still be a little better than what we have now.

As far as I understand, the reality is that the Far installations you can download from Github and from the main website will have different hashes because they are built by different processes.

Login • Register