Welcome to part seven of this module.
In this video we're going to be looking at how to verify the authenticity of the files that we download
using G.P.S. for windows.
We'll also be covering how to get the various check sums for files using shots on checker.
And this will be crucially important for the next few classes in this module.
If you haven't watched the previous video you may need to go back and do so before proceeding because
you will need GP G for Windows installed on your computer.
The next video right after this one will be covering the Tor anonymity project.
We'll be going into detail about what Tor is what it is not and how to use it and how it is used.
Will then be looking at the tables operating system which fully employs tor for all of these entries.
It will be important to know how to verify the authenticity of the files that we're using.
It is possible to falsify a web page or in some other way trick someone into downloading a malicious
file with with both Tor and tails.
It is imperative that we know that we're using a trusted copy.
If the Tor installer or the Thales iso file were to be in some way compromised then we might lose all
and anonymity while believing ourselves to be anonymous and such tiny changes to these files would not
be detected by an antivirus or malware scanner.
So what we're going to do is we're going to navigate over to the Tor Project dot org and once again
we will be covering Tor in the next video.
But for right now let's go ahead and download a copy of the browser bundle by clicking the download
link and notice that there is a 32 bit version of Tor available for older machines.
Go ahead and click download and grab the version that is right for your operating system.
Most of you will probably be using 64 bit by now.
The file will download normally with the file now downloaded the next thing we do is check the TGP signature.
So we're going to come over here and it's right underneath the file download option.
And if you downloaded 32 bit it's going to be down here.
When I click on Sig in parentheses hopefully this looks familiar to you by now.
We'll want to highlight this P.G. peaky the whole thing.
We're going to copy it to the clipboard.
This is going to be our signing file in addition to this.
We're going to need the installer which we've already downloaded as well as the signing key from the
developers.
Now if you recall from the last video we want to paste this block of text here that is our key into
a text file.
So let's go ahead and open up notepad pasted in there and we're gonna save the file to the desktop as
Tor key dot ASIC and we'll go ahead and save it to the desktop with the AFC extension we could also
use the PDP extension if we wanted to.
Next we're going to grab the Tor developers signing key.
Unfortunately the Web site doesn't make it immediately obvious how to do this which I personally think
is a little frustrating for a security project.
We need to start out by clicking on this tiny link right here next to the sig that we just clicked on.
What's this in tiny text.
And now we're going to scroll down to where it says.
Where do I get the signatures and the keys that made them.
I'm we're gonna click on the link for the signing keys page.
Here we have a list of keys from the developers.
Let's go ahead and highlight the Tor Browser development key which is the string of text right here.
The Tor Browser developers we're going to click copy.
Now notice that the zero and the X are not highlighted.
Those are not part of the key and the parentheses isn't supposed to be there but it's very hard to highlight
this link.
So what you really just want is everything after the X and before the closing parentheses we're going
to go ahead and we're going to open up or GPA key manager and we're going to go up to server select
retrieve keys and we're going to post the key I.D. paste excuse me and I'm going to get rid of the little
closing parentheses.
So it's just the string of numbers and letters and we're going to click Okay.
There we go.
You should see that the Toure browser developers public key has now been added to our key manager.
If for some reason you get an error message make sure that your firewall is not blocking your key manager
since it's pulling down the key from the server.
OK great.
Everything is setup.
So what we're going to do is going to enter some commands into the command line.
I'm sure everybody is comfortable with that.
If they're taking this class.
So for older Windows we're going to load up CMT
and for Windows 10 we would just right click on the appropriate directory and select windows power shell.
So we're going to navigate over to the directory if we need to and we're going to enter the command
G P G Tac tac verify or dash dash if you prefer.
We're going to put in our key which is the text file that we just saved and then we're gonna do a space
and we're going to drag in the installer file that we wish to verify and press enter.
This may take a few moments.
Lo and behold GP G reports good signature from the tour browser developers.
That being said we also get this warning telling us that the key is not certified with a trusted signature.
If you remember back to the previous video you may recall that newly imported keys have an unknown level
of trust.
By default the first P GP key verifies that the installer we just downloaded has a good signature but
the key was signed by the developer citing key and how do we know if that is real.
The truth is we can never be 100 percent sure unless we know the developers and he or she is able to
personally verify for us.
One thing that will be covered more as we go into the deep web a.k.a. the darknet is what are called
webs of trust individuals who know each other and are very into encryption will often exchange keys
in which case they can in fact be trusted.
If you're getting it directly from the source they can give you the fingerprint.
Now of course the fingerprints are located right down here for these keys but we're getting them from
the same source as the key itself.
So do we really trust them.
So the best practice here of course is going to be to use your own judgment.
But we do have a second method of verifying that this file is what we think it is.
But first I just want to show that if we go back to our key manager and if we right click on the key
and set owner trust and signify that we do in fact trust this key because remember it's not trusted
by default.
And if we run the check again this time there will be no warning the signature will come back good and
everything is golden.
So this was one way of verifying the file.
There is one other step we can take beyond verifying the key provided we can use a short sum checker
to look at the check some values of the file in question.
There are in fact many different ways to do this but the easiest is to just go ahead and download the
shore some checker utility which is free.
So we're going to navigate over to this web page Raymond's word press empty five and shore check some
utility.
Of course you can purchase that if you wish.
I'm going to download from the mirror download from soft PDA and click download now
installation is very straightforward.
We'll just open the installer then we'll select the Tor installation file and open it.
And after a moment it will calculate all of the different hash values of the file.
Then we're just going to go ahead and we're going to highlight the name of this file
copy it to the clipboard.
We'll come back over here and this is a list of all of the Shah 256 values of all of the different distributions
of the Torah installer and rather than search through this list by hand.
We're going to use control F to find and in the Find box we're going to paste in the name of the file.
And here it is.
This is the appropriate file that we're looking for and we're going to copy this SHA 256 hash COME RIGHT
DOWN HERE TO OUR checker.
Paste it into the hash box and click VERIFY AND WE CAN SEE THAT THE SHA 256 hash does in fact match.
And that's kind of all there is to it.
There are often multiple places online where you can find the values for any file that you download.
If the file has been tampered with in any way after the original was created these hash values will
be altered and the verification will not match.
So even if the signing keying is in question there is a second way to verify and make sure that you're
downloading what you think you're downloading and that it's actually what it seems an altered version
of Tor or an installer with a payload attached isn't going to match up this method of verification is
particularly handy for larger files such as ISOs that you can't easily upload a virus total or otherwise
scan and look over in a timely manner.
The more sources of verification that you use the better as they tend to support each other.
If one or the other does not verify that you have reason to be suspicious and might consider further
checking the file before you go ahead and install it it is not enough to rely on antivirus to check
things like Tor and tales because their nature is such that if they were even suddenly tampered with
the privacy that they offer could be compromised in a way that no scanning tool would ever detect or
recognize even something as simple as changing whether or not javascript is allowed by default can compromised
tor security.
All of this will be covered at greater length.
The next video when we dive into tor entails a final example that I wish to throw in.
Ah the true crypt seven point one a hashes.
And that's because it was pointed out to me that some people were having a hard time finding them.
Well here they are.
And what we're going to do is going to grab the seven point one a setup hash
copy it and then we're going to add it into the checksum manager and it calculated immediately delete
the old loops or delete the old hash and replace it with the one that we just copied pasted in there
and it verifies just fine.
And there we go.
It is always a wise policy to research and check out any piece of software that pertains to privacy.
The chances of it containing a payload or a virus are probably pretty low.
But hackers and even intelligence agencies do like to put compromised copies out there into circulation
antivirus will not detect tiny alterations in the code that make the programs not function quite as
desired.
Introducing a weakness into the encryption or tweaking a setting that exposes you when you think you're
anonymous doesn't really qualify as malware as false.
As far as most scanners are concerned.
So it's always good to check.
Thank you for your attention.