Hacker News new | ask | show | jobs
by kbirkeland 2616 days ago
Is your argument that you only need integrity if you verified the authenticity out of band?
1 comments

No, I'm saying you only need integrity to validate you are getting the same thing each time. If I checked and made sure an image is safe, then I can save that hash and know that as long as the has matches, I'm always getting that same safe image.
This is useless without authentication though. You're opening yourself up to attacks on the first retrieve. Sure, you can make sure you're getting the file they want you to have, but you don't know _who_ is giving you that file.