A Study on the Use of Checksums for Integrity Verification of Web Downloads

Abstract

App stores provide access to millions of different programs that users can download on their computers. Developers can also make their programs available for download on their websites and host the program files either directly on their website or on third-party platforms, such as mirrors. In the latter case, as users download the software without any vetting from the developers, they should take the necessary precautions to ensure that it is authentic. One way to accomplish this is to check that the published file's integrity verification code-the checksum-matches that (if provided) of the downloaded file. To date, however, there is little evidence to suggest that such process is effective. Even worse, very few usability studies about it exist. In this paper, we provide the first comprehensive study that assesses the usability and effectiveness of the manual checksum verification process. First, by means of an in-situ experiment with 40 participants and eye-tracking technology, we show that the process is cumbersome and error-prone. Second, after a 4-month long in-the-wild experiment with 134 participants, we demonstrate how our proposed solution-a Chrome extension that verifies checksums automatically-significantly reduces human errors, improves coverage, and has only limited impact on usability. It also confirms that, sadly, only a tiny minority of websites that link to executable files in our sample provide checksums (0.01%), which is a strong call to action for web standards bodies, service providers and content creators to increase the use of file integrity verification on their properties.

An Empirical Study of the Usage of Checksums for Web Downloads

“…Finally, through a user survey (𝑁 = 2000), they show that most internet users do not understand the purpose of checksums found on download pages. In a follow-up study, Meylan et al [13] studied, through an in-the-wild experiment (𝑁 = 134), the exposure of internet users to checksums and their reactions.…”

“…To enable researchers and practitioners to reproduce our work and to benefit from its result, we make our dataset and the code for collecting and analyzing it available on OSF. 13 More specifically, we provide (1) the pre-trained model-in the PMML format-of our classifier (for identifying webpages w/ checksums), together with a minimal example of how to use it in Python + sklearn, (2) our enriched dataset of webpages with checksums, together with the annotations (csv and sqlite), (3) the code of our crawler, and (4) the full transcript of our questionnaire.…”

TPBF: Two-Phase Bloom-Filter-Based End-to-End Data Integrity Verification Framework for Object-Based Big Data Transfer Systems

“…Checksumming is the most basic implementation of end-to-end data integrity [14]. Both sink and source endpoints retrieve the data from storage after a successful data transfer and then calculate the checksum with a hash technique including SHA1 [15] or MD5 [16].…”