下载应用程序时 MD5 哈希值的用途是什么？
我从未在程序主页上检查过 MD5 哈希值并将其与真实的 MD5 哈希值进行比较。 我下载的程序一直有效。
有人可以在下载时输入自己的代码吗？
I have never checked and compared the MD5 hash to the real MD5 hash at programs homepages.
Programs which I have downloaded have always worked.
Is it possible that someone can put their own code during downloading?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（9）
哈希根据文件的内容为文件提供（某种）唯一标识符。 由于连接有损、传输方法不佳，以及恶意文件副本四处传播，哈希提供了一种方法来证明您的文件与您尝试从服务器下载的文件相同。
您可以通过对获得的文件副本进行哈希处理并查看哈希值是否相同来验证它。
人们可以注入恶意代码，更改正在下载的文件，或者您可能会得到损坏的下载。
A hash provides a (sort of) unique identifier for a file based on its contents. With lossy connections and poor transmission methods, as well as malicious file copies floating around, a hash provides a way of proving your file is the same file you tried downloading from the server.
You validate it by hashing the copy of the file you got, and seeing if the hashes are the same.
People can inject nasty code, change out the file being downloaded, or you could just get a corrupt download.
就损坏的下载而言，这种情况非常罕见。 我想我从来没有下载过损坏的文件，除非它以某种方式被截断并且没有报告错误（当时的旧 FTP 客户端）。
如果您从镜像下载，并且您对真实站点（发布 MD5）的信任程度超过对镜像（镜像可能已过时，或邪恶，或有缺陷，或被破解，或者其他东西，它和你之间可能有一个缓存网络代理）。 不过，这种情况不太可能发生，因为通常没有理由认为主站点比镜像站点或多或少值得信赖或安全。 不过，这是第二种意见。
我通常不会去检查已发布的校验和，除非有特殊原因认为它们是正确的并且下载不安全（例如，校验和位于 https URL 上，而下载则不是）。 如果您担心作恶者，那么您需要签名，而不仅仅是不安全传输的校验和。
不过，我偶尔也会使用virustotal 上基于哈希的病毒扫描报告。 我猜想发布的 MD5sum 可以让您在下载文件之前对其进行病毒检查，然后您必须在下载后检查该文件的总和，以确认您病毒检查的值确实是您下载的文件的值。
请注意，如果作恶者既生成真实文件又生成恶意病毒加载文件，那么 MD5 校验和就不安全。 尽管还没有完整的原像攻击，但还是有可能生成 MD5 冲突。 任何认真对待安全性的人都会尽可能改用 SHA256 和。 由于遗留和资源原因，这可能比您希望的要少。
In terms of corrupt downloads, it's pretty rare. I don't think I've ever had a corrupted download except if it somehow got truncated and the error not reported (old FTP clients back in the day).
There might be some security benefit if you're downloading from a mirror, and you trust the real site (which publishes the MD5) more than you trust the mirror (which might be out of date, or evil, or buggy, or pwned, or something, and so might a caching web proxy between it and you). Pretty unlikely situation, though, since there's normally no reason to think that the main site is any more or less trustworthy or secure than the mirror. Still, it's a second opinion.
I don't usually bother checking published checksums unless there's a particular reason to think that they are correct and the download isn't secure (e.g. the checksum is on an https URL and the download isn't). If you're worried about evil-doers then you need signing, not just an insecurely-transmitted checksum.
I do occasionally use the hash-based virus scan reports at virustotal, though. I guess a published MD5sum could allow you to virus-check the file before even downloading it, and then you'd have to check the sum after download to confirm that the value you virus-checked really was for the file you downloaded.
Note that MD5 checksums are not secure if the evil-doer generates the genuine file as well as the dodgy virus-loaded one. It's possible to generate MD5 collisions, although there is not (yet) a full pre-image attack. Anyone serious about security has switched to SHA256 sums where possible. Which is less than you might hope, for legacy and resource reasons.
是的。 如果下载是通过未加密的 HTTP 完成的，那么它会通过多个网络进行路由，并且人们肯定有机会操纵它并插入木马或病毒。
这正是下载的 MD5 校验和的目标，尽管这当然不是完美的安全性，因为校验和可能会以相同的方式被操纵。 但这需要攻击者付出更多的努力和协调。
总而言之，这并不是一个非常常见的问题，因为目前还有其他攻击媒介对坏人来说更有用（主要是网络浏览器漏洞）。
Yes. If the download is done via unencrypted HTTP, then it's being routed through a number of networks, and there most definitely is an opportunity for people to manipulate it and insert a trojan or virus.
And this is exactly the goal of the MD5 checksums for downloads, though this is of course not perfect security, since the checksum may be manipulated in the same way. But it would require more effort and coordination on the part of the attacker.
All in all, this is not a very common problem though, since there are other vectors of attack that are currently much more useful for bad guys (mainly webbrowser vulnerabilities).
可以检查文件是否损坏。 这就是我想的。
File can be checked if it is corrupted. Thats all I think.
MD5 哈希是一种验证形式。 如果文件中的一位不同，则提供的哈希值将与您下载的文件生成的哈希值不匹配。 这会提醒您传输错误或犯规行为（罕见）。
An MD5 hash is a form of validation. If a single bit in the file is different, the provided hash will not match the one generated from the file you downloaded. This alerts you to an error in transmission or foul play (rare).
除了使您能够确保获得您尝试下载的代码（它没有被有意或无意地损坏）之外，如果您检查哈希值，那么在发布代码时包含哈希值的做法是良好的社会卫生。 由于共享或销售软件的人通常在他们的代码中包含哈希值，并且我们相信有些人会定期检查它们（因为某些下载工具会自动执行此操作），黑客会发现这是一种不太有用的传播恶意软件的方式。 因此，那些只检查安全关键软件的哈希值或从不检查哈希值的人可以更加确信该软件确实如其所声称的那样。 如果破解者试图开始将病毒或木马注入常用的下载站点，它们会很快被检测到，并且攻击会被修复和公开。
因此，您可以通过偶尔检查来帮助每个人，即使您不这样做，哈希值的存在也应该提供一些保证，即代码可能符合作者的意图，并且许多其他人下载了相同的代码。
In addition to enabling you to be sure you got the code you tried to download (it wasn't corrupted either intentionally or accidentally), if you check the hash, the practice of including hashes when publishing code is good social hygiene. Since people who share or sell software often include hashes with their code, and we believe that some people routinely check them (because some download tools do it automatically) crackers will find this to be a less useful way of spreading malware. Therefore, those who only check the hash on security-critical software, or those who never check can have more confidence that the software is what it purports to be. If crackers tried to start injecting viruses or trojans into often-used download sites, they would be detected pretty quickly, and the attack repaired and publicized.
So, you can help everyone by occasionally checking, and even if you don't, the presence of the hashes should provide some reassurance that the code is probably as the author intended it, and the same code downloaded by many other people.
它基本上回答了与身份验证相同的问题——声称自己就是那个人的人是否真的就是那个人。 它可以帮助您确保您下载的程序实际上是作者最初提供的程序，并且在从供应商到您的桌面的整个过程中没有被篡改。
It basically answers the same question as authentication - whether the one who says he is the one is actually the one. It helps you to make sure that the program you've downloaded is actually what author is provided in the first place and was not tampered on the way from the vendor all the way through the maze of the internet into your desktop.
我大部分时间都检查md5。 虽然可能只有一两次，是的，我确实得到了损坏的下载。
如果你下载了一些东西，检查它的md5并与文件一起存储，这也可能是以后检查发布者是否在不告诉任何人的情况下秘密更改文件的一种方法。
I check md5 most of the time. Although maybe just once or twice, yes, I did get corrupt downloads.
If you download something, check its md5 and store along with file, it may also be a way later to check if the publisher has secretly changed the file without telling it to anyone.
完全浪费时间。
黑客会更改哈希值和二进制文件，因此这只是针对无能黑客的安全措施。
大多数下载的二进制文件都是通过内置的错误检查进行压缩的，因此散列完全没有实现任何目标，这就是为什么除了极客之外我从未见过任何人真正使用它们。
现在，软件包安装程序使用的数字签名哈希是不同的且有价值的。
Complete waste of time.
A hacker would change the hash as well as the binary so it is only a security measure against incompetent hackers.
Most downloaded binaries are compressed with built in error checking, so the hash achieves precisely nothing which is why I've never seen anyone besides geeks actually use them.
Now a digitally signed hash used by a package installer is something different and worthwhile.