Downloading files on your device still exposes a major security risk and can ultimately lead to an entire system compromise by an attacker. Especially because the security risks are ...
  • @pinknoise
    4•3 years ago

    Whoever downloads and runs executables without a second channel for verifying their authenticity is fucked anyways https or not :/

    • @nVZWmCa67Tq0SQkXPR
      2•3 years ago

      A lot of downloads do not make it easy to verify it’s checksums either to verify the authenticity of the file even if you’re downloading from a source that is credible

    • @blkpws
      2•6 months ago

      deleted by creator

      • @pinknoise
        2•3 years ago

        So better show the checksum after downloading

        If you got the checksum via a different channel or if it’s signed with a key you’ve got from elsewhere. (ideally, or just TOFU) Otherwise you’re still “only” trusting the https connection.

  • CarrotsHaveEars
    3•3 years ago

    I hate that Firefox on Android changes the extension to .bin when the original file doesn’t have one. I think it’s very stupid. Chrome is loyal to the source.