Hacker News Reader

Comment by michaelmior | Hacker News Reader

It seems the online tool does nothing other than compute the SHA-1 hash. Given that it seems the documents that a user would want to hash for this method are likely to be sensitive, it seems prudent to suggest that users use an offline method of generating the hash.

View on HN

Here's my exploration of asm.js and the file API for making a offline SHA256:

https://rawgithub.com/kristofferkoch/web-lafs/master/test/sh...

Thanks. I am using https://code.google.com/p/crypto-js/#SHA-2 but no web workers yet, this can be a problem with large files.

Yes it is just a helper to compute a SHA256 of a file and generate output in hexadecimal. The "online tool" runs client side, nothing is sent to a server. You can read its sources to be sure about this.

That would require every user to validate the sources themselves.

See, I could read your code today and recommend the site to my friend as safe, but you can then change what you serve from day to day or even from user to user (So that only likely targets are served a malicious version)

We should dynamically compute a hash of the source files client-side and compare it with a previous hash validated by a trusted third party and available online. If they don't match, the client displays a red warning :)

I don't understand this point. In any case, the point is that we may trust your site today, but it may be compromised in the future. In which case it also can't be trusted to show any sort of warning.

Good idea in theory but it doesn't really work. If someone (like you) can change the code that the client gets then they can simply remove or fake the hash checking code.

Sure, a firefox extension could do that.

Reply on news.ycombinator.com