Changes between Version 4 and Version 5 of Are the packages signed

Timestamp:

Sep 21, 2012, 3:53:48 AM (11 years ago)

Author:

datallah

Comment:

Additional tweaks and grammatical improvements

Are the packages signed

@@ -1 +1 @@
 == What is a signature and why should I check it? ==
-When you download a file from the internet, you don't have a good way of knowing if it may have been tampered with.  It's not beyond the realm of possibility that someone could release a patched version of pidgin that transparently captured your passwords and uploaded them to some server.
 
-This is where signatures come in - file signatures are very similar in concept to the idea behind signing both the back of your credit card, and a credit card receipt.  The signature is a verification that the file came from who it was expected to come from.
+The fact that you're using pidgin means that you have some level of trust in the authors, but It's not beyond the realm of possibility that someone else could make an "evil" patched version of pidgin which would steal your sensitive data without your knowledge.
 
-You probably have noticed that vendors frequently don't bother to compare the signature on the receipt to the signature on the back of the card, which makes it so that anyone could have been using the credit card (let's pretend that the signature on a credit card slip isn't trivially easy to forge).  Similarly, if you don't verify the signature on a file, even if the file is signed, you don't have any confidence that it came from where it was expected to come from.
+When you download a file from the internet, unless you take additional steps, you don't have a good way of knowing if the file may have been tampered with.  If you were to somehow end up with the "evil" version instead of the official release, how would you know the difference?
 
-Due to the nature of how signing works, an additional benefit is that if you verify the signature, you can be confident that nothing got corrupted during the download process - the file you have is exactly as it was when it was signed.
+This is where signatures come in - file signatures are very similar in principle to the idea behind signing both the back of your credit card, and a credit card receipt (pretending that the signature on a credit card receipt isn't trivially easy to forge for the purpose of this example).  The signature can be used to verify that the file came from whom it was expected to come.
+
+You probably have noticed that vendors frequently don't bother to compare the signature on the credit card receipt to the signature on the back of the credit card.  When this happens, the vendor can't be confident that the person using the card is actually the card's owner.  Similarly, if a file isn't signed, or you don't verify the signature on a signed file,  you can't be sure that it came from where it was expected to come from.
+
+Due to the nature of how signing works, an additional benefit is that when you verify the signature, you can be confident that nothing got corrupted during the download process - the file you verified is exactly as it was when it was signed.
 
 == Source Tarballs ==
@@ -32 +35 @@
 
 The signature can be verified most easily by using Windows Explorer to look at the Properties of the installer executable.
-In the "Digital Signatures" tab, you can look at the Details of the signature, "View Certificate", and compare the (case-insensitive, whitespace-insensitive) "Thumbprint" value in the "Details" tab to the value listed above.[[Image(windows_cert_verify_thumbprint.jpg)]]
+In the "Digital Signatures" tab, you can look at the Details of the signature, "View Certificate", and compare the (case-insensitive, whitespace-insensitive) "Thumbprint" value in the "Details" tab to the value listed above.
+
+[[Image(windows_cert_verify_thumbprint.jpg)]]
 
 Alternatively, the signature can be verified using Microsoft's `signtool.exe` utility (which, unfortunately, in order to obtain, requires that you install the at least parts of Microsoft Platform SDK).