Downloading with Asfaload

About Asfaload

Asfaload maintains a mirror of checksums files aiming to increase the security of downloading files from the internet. When projects publish checksums files in their releases, and if these checksums where mirrored by Asfaload, it will be indicated by the presence of the link "Download with Asfaload". The Asfaload mirror can be used transparently by using Asfald, a downloading tool that will automatically use the mirrored checksums file in addition to the release's checksums files.

Why does it increase security

As Asfald uses both the project's checksums and the mirrored checksums, both location need to be compromised for an attacker to make you download a compromised file undetected. The caveat is that a checksums file altered before it was mirrored will not be detected. But once the mirror is taken, if either of the copies is modified, it will be detected by the downloader. To further improve security and fix said caveat, Asfaload is working on a solution to easily sign and authenticate releases.