Idea

Jon Abbott avatar image
2 Likes"
Jon Abbott suggested Jon Abbott commented

Post digitally-signed cryptographic hashes for verifying FlexSim installer integrity/authenticity

I would like to suggest posting cryptographic hashes alongside installer download links to ensure installer integrity and authenticity. I would recommend SHA-2 or newer, as earlier hash functions have collisions or other known issues. It would also be useful to sign the cryptographic hashes with digital signatures to ensure that the hashes have not been tampered with. Thanks for considering my suggestion.

installersecurityfile authenticityfile integrity
5 |100000

Up to 12 attachments (including images) can be used with a maximum of 23.8 MiB each and 47.7 MiB total.

Phil BoBo avatar image
3 Likes"
Phil BoBo commented Phil BoBo edited

The FlexSim installer is already digitally signed and ships with the digital certificate that Windows verifies. You can see it when you run the installer and the UAC prompt appears. The UAC prompt shows "Verified Publisher: FlexSim Software Products, Inc." if the file has not been tampered with:

You can press the Show details button to look more closely at the digital certificate that it is signed with. Our installers are signed with a Symantec Class 3 Extended Validation Code Signing certificate.

If the file has been tampered with, then Windows will show "Publisher: Unknown" instead of our verified publisher name:

Also, if you are using Windows 8 or later, the Microsoft SmartScreen will appear and warn you if the installer has been tampered with, even if it has been signed by an untrustworthy actor (such as someone signing it locally with a faked publisher name).

· 1
5 |100000

Up to 12 attachments (including images) can be used with a maximum of 23.8 MiB each and 47.7 MiB total.

Jon Abbott avatar image
0 Likes"
Jon Abbott commented

Hi @phil.bobo, I just downloaded the 64-bit .msi version of FlexSim 19.0.2 and it is saying the publisher is unknown. Please see the image below. I downloaded the file twice to confirm that it wasn't a result of file corruption while downloading. Are the latest .msi versions of FlexSim still being digitally signed?

· 4
5 |100000

Up to 12 attachments (including images) can be used with a maximum of 23.8 MiB each and 47.7 MiB total.

Your Opinion Counts

Share your great idea, or help out by voting for other people's ideas.

Related Ideas