5

I use the Tor Browser Bundle for software downloads because I can not use the internet for this without Tor. Windows and Linux software download sites often do not use HTTPS, so I run the risk of having my downloads modified by the exit node without my knowledge. What is the correct way to verify my downloads are safe?

4

Whilst not as certain as verifying downloads by MD5 hash/checksum, an alternative would be to download the same files multiple times using "New Identity" in Torbutton (or "Use New Identity" in Vidalia). The chances of randomly picking a bad exit that would tamper with your particular download and which hasn't been flagged yet is already fairly low. The chances of this happening multiple times with different exit nodes decreases exponentially.

Once you have a couple of copies of the same file you can compare your own checksums. If they match, then it's pretty likely that you're safe.

| improve this answer | |
  • It should be sufficient to download the hash several times over different circuits. If the value fits the download probably is correct. If it differs the user should download the software again. – Jens Kubieziel Dec 13 '13 at 10:26
  • Yes, presuming the site even shows the hash (whether you should download software without having a checksum to verify is another subject entirely). – Andrew Lott Dec 13 '13 at 10:58
  • One thing to consider about downloading multiple times using new identity: While it does decrease the probability of an undetected bad/tampered download, it also increases the probability that an observer can tell it was you. This is what guard rotation strategy is supposed to prevent. (I'm not sure whether 'new identity' gives you new exit only or completely new circuits including guards as well, but still..) – Jobiwan Dec 18 '13 at 9:07
3

The site you download from probably lists MD5 sums for the files they offer. So you can use that to verify the integrity of your downloads. Of course the exit node could have tampered with that too, so to double check, you can google the MD5 sum and see if it comes up with the right file.

At this point you should also decide who you (dis)trust more: the exit node or the site you download from.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.