Earlier quoted context omitted.
well it does require one that can't have collisions. otherwise what's the point in "verifying"?
There is no hash function that can't have collisions by definition.
*isn't known to have collisions, then
HandBrake 1.0.0 Released
131–140 of 181 posts
Re: HandBrake 1.0.0 Released
#132Earlier quoted context omitted.
I once knew of a group like this. eventually, thy disappeared - but it was the most wonderful way to access otherwise unavailable arthouse and experimental cinema. I miss it.
I'm curious: how did they meet? Secure irc?
Also read the "how music got free" book, covers allot of that stuff.
Re: HandBrake 1.0.0 Released
#133I hope this fixes the issue I, but seemingly few others have, which is that the sound drifts behind the video getting progressively worse as the video continues. By 60 minutes in the sound is a full five second behind the video.
Does this only happen when using variable bit rate audio, or does this happen with fixed bit rate audio as well?
Re: HandBrake 1.0.0 Released
#134Earlier quoted context omitted.
Verifying a downloaded file doesn't require a cryptographically secure hash function...
Of course it does, otherwise a malicious mirror can (theoretically) work to find a collision between their malware and the legitimate file and serve you the former. There's no good reason not to use a secure hash function.
It would be pretty impressive, as they'd need their malware to both do what they want and exactly match that hash. Not impossible, just clever.
Re: HandBrake 1.0.0 Released
#135Re: HandBrake 1.0.0 Released
#136Re: HandBrake 1.0.0 Released
#137What a really nice Christmas present from the HandBrake team! Kudos, it's my favorite video transcoder since it's debut on BeOS back then...
Re: HandBrake 1.0.0 Released
#138Don't use SHA-1 please.
They have moved away from SHA-1, and are now using SHA-256. Previous releases were signed with SHA-1, and before that it was MD5: https://handbrake.fr/checksums.php
I'm not sure why they haven't retroactively calculated checksums for older versions.
But you're right that SHA-1 needs to stop being used: https://sites.google.com/site/itstheshappening/
These researchers have found the first "freestart" collision, and they estimate the SHA-1 collision cost to take a few months, costing between 75K$ and 120K$.
Practically speaking, I don't think anyone could make a profit by forging a Handbrake release, but the FBI probably do have some very high-profile targets who use video encoding software.
Re: HandBrake 1.0.0 Released
#139Earlier quoted context omitted.
> I'm a little surprised they aren't signing their MacOS releases. Do any small developers actually do this? It seems entirely useless from a security prospective. You go through an expensive process so that at the end it can "verify" that the binary was signed by an individual the user has never met who may not even live in the same country and for all anyone knows is perfectly willing to sign ransomware, or who has…
> If you don't actually know and trust the party who makes the software then the signature is worse than useless Not true. The signature only needs to mean "we've verified the author's ID and he lives in a country that enforces the law". Then if he ships and signs malware, he can be sued and/or charged criminally.
> The signature only needs to mean "we've verified the author's ID and he lives in a country that enforces the law". Then if he ships and signs malware, he can be sued and/or charged criminally.
This is what I mean by worse than useless. Promoting reliance on the signature to mean something.
To pick a country, quite a lot of entirely legitimate software comes out of Russia. So does a lot of malware. Does Russia enforce the law? Sure, against people who aren't politically connected. Some of the malware authors are, so you're screwed. You can't just write off a country like that. There is still a baby in that bathwater. And that's not the only country with organized crime or corruption.
As soon as you have many small developers signing things you can't even really exclude by country at all because there are too many soft targets for malware authors to steal keys from. Some college student gets a signing key to sign his calculator app and then gets hacked, and now there is malware signed by John Smith of New Jersey. By the time anyone figures it out the attackers, now equipped with the false sense of security created by the signature, have hacked many other people and captured even more signing keys.
It's like security theater where the criminals pick your pocket while you're distracted watching the show.
Re: HandBrake 1.0.0 Released
#140...Wait, it wasn't 1.0 already? Could've fooled me...
Honestly, it already felt like a 1.0 product back when Netflix was a new company.