4

I use the Tor Browser Bundle for software downloads because I can not use the internet for this without Tor. Windows and Linux software download sites often do not use HTTPS, so I run the risk of having my downloads modified by the exit node without my knowledge. What is the correct way to verify my downloads are safe?

Improve this question

2 Answers 2

Reset to default
2

The site you download from probably lists MD5 sums for the files they offer. So you can use that to verify the integrity of your downloads. Of course the exit node could have tampered with that too, so to double check, you can google the MD5 sum and see if it comes up with the right file.

At this point you should also decide who you (dis)trust more: the exit node or the site you download from.

Improve this answer
2

Whilst not as certain as verifying downloads by MD5 hash/checksum, an alternative would be to download the same files multiple times using "New Identity" in Torbutton (or "Use New Identity" in Vidalia). The chances of randomly picking a bad exit that would tamper with your particular download and which hasn't been flagged yet is already fairly low. The chances of this happening multiple times with different exit nodes decreases exponentially.

Once you have a couple of copies of the same file you can compare your own checksums. If they match, then it's pretty likely that you're safe.

Improve this answer
3
  • It should be sufficient to download the hash several times over different circuits. If the value fits the download probably is correct. If it differs the user should download the software again.
    – Jens Kubieziel
    Commented Dec 13, 2013 at 10:26
  • Yes, presuming the site even shows the hash (whether you should download software without having a checksum to verify is another subject entirely).
    – Andrew Lott
    Commented Dec 13, 2013 at 10:58
  • One thing to consider about downloading multiple times using new identity: While it does decrease the probability of an undetected bad/tampered download, it also increases the probability that an observer can tell it was you. This is what guard rotation strategy is supposed to prevent. (I'm not sure whether 'new identity' gives you new exit only or completely new circuits including guards as well, but still..)
    – Jobiwan
    Commented Dec 18, 2013 at 9:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .