Re: Firefox extensions updated over plain HTTP (not HTTPS)

[Justin Dolske]

On 1/4/09 9:10 PM, Bil Corry wrote:

If the data was tampered with,
the hash won't match and the bad update won't be applied.

Which hash algorithm is used?

SHA-1.

Example link:

https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=2&id=inspec...@mozilla.org&version=2.0.1&maxAppVersion=3.2a1pre&status=userEnabled&appID={ec8030f7-c20a-464f-9b0e-13a3a9e97384}&appVersion=3.1b3pre&appOS=Darwin&appABI=x86-gcc3&locale=en-US&currentAppVersion=3.1b3pre

Justin
_______________________________________________
dev-security mailing list
dev-security@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security