Re: Firefox extensions updated over plain HTTP (not HTTPS)

Sun, 04 Jan 2009 22:20:35 -0800 

On 1/4/09 9:10 PM, Bil Corry wrote:


If the data was tampered with,
the hash won't match and the bad update won't be applied.


Which hash algorithm is used?


SHA-1.

Example link:

https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=2&[email protected]&version=2.0.1&maxAppVersion=3.2a1pre&status=userEnabled&appID={ec8030f7-c20a-464f-9b0e-13a3a9e97384}&appVersion=3.1b3pre&appOS=Darwin&appABI=x86-gcc3&locale=en-US&currentAppVersion=3.1b3pre

Justin
_______________________________________________
dev-security mailing list
[email protected]
https://lists.mozilla.org/listinfo/dev-security






















					Reply via email to