Should information like this be provided over an insecure HTTP connection? signi...

lern_too_spel · on Oct 6, 2014

No.

Now you've learned a valuable lesson about asking a rhetorical question on the internet. None of the other responders knew the correct answer.

marktangotango · on Oct 6, 2014

http://en.wikipedia.org/wiki/Public-key_cryptography

ddevault · on Oct 6, 2014

Eh, I think it's fine. I advocate for HTTPS everywhere but I don't think this particular bit of information is so sensitive as to demand encryption.

vinceguidry · on Oct 6, 2014

Public keys are intended to be public. So long as you're not transmitting them over the same connection as the one you're using them in, you're golden.

dbpatterson · on Oct 6, 2014

The point of HTTPS is not to hide things, it's to prevent tampering... Which seems relevant when transmitting checksums.

vinceguidry · on Oct 6, 2014

That problem can be solved by retrieving the key out of band. If you're that worried about it, use a VPN to verify that the key you're seeing is the right key. That will vastly increase the difficulty of pulling off a successful attack. They'd have to MitM both connections, as well as the connection you're using to download the software, in order to compromise it.