Re: Standardizing Firefox's Implementation of Link Fingerprints

["Edward Lee" <[e-mail]>]

On 7/2/07, Dave Crocker <[e-mail]> wrote:
> Although this sounds like an entirely reasonable option to add to URLs, I'm
> curious just how much of a problem there is with downloads that are trojaned
> using the correct domain name?

One main use case of Link Fingerprints is for file mirroring networks.
The portal server with high security can link to 3rd party mirrors
that may or may not have the correct file that is being distributed.
With just some clients supporting Link Fingerprints, the users that
see the problem can report to the site administrator to quickly
resolve the problem.

For a recent example, WordPress announced on March 2, 2007 that some
copies of version 2.1.1 was hijacked.

"It was determined that a cracker had gained user-level access to one
of the servers that powers wordpress.org, and had used that access to
modify the download file. We have locked down that server for further
forensics, but at this time it appears that the 2.1.1 download was the
only thing touched by the attack. They modified two files in WP to
include code that would allow for remote PHP execution." [1]

Ed

[1] http://wordpress.org/development/2007/03/upgrade-212/