How does verifying the checksum confirm the integrity of a downloaded file, when it’s posted on the same website the file came from?
In: 27
There are a few situations where the checksum can help:
1. Sometimes to save on hosting/bandwidth costs, the download link will actually pull the file from a different website not under direct control of the website author. For example, a number of universities will host the files for Linux distributions. Then the website for the Linux distribution will randomly select from the list of known hosts.
2. It allows you to verify that the file was downloaded correctly. Whenever you have an application that downloads a file in parts and stitches them back together, there’s a chance that something goes wrong and some data is out of order at the stitching points. Thus the checksums are very helpful if someone is using a download manager that resumes a download when the connection is interrupted. BitTorrent clients are supposed to automatically verify the checksums. But I’ve occasionally had a Linux distro fail its checksum after download.
3. In a few cases, the checksums are digitally signed with a form of encryption. This has the added advantage that even if hacker takes over the website, they won’t be able to produce a valid checksum file. So anyone who goes through the effort of performing the verification will realize that the download has been tampered with.
Latest Answers