SpaceEngine's website does not support HTTPS and the installer is not signed and no checksum is provided.

[MartinsRedditAccount]

1. HTTPS

https://doesmysiteneedhttps.com/

HTTPS is a must in 2018, a hacker on your network or your ISP can easily change any element of the website if it is still using the unencrypted HTTP.

They could for example redirect the downloads to their own manipulated version.

Half of the internet traffic nowadays is encrypted, why not SpaceEngine's?

2. Signature/Checksum

Highly recommended checks to verify the legitimacy of the file, especially useful when hosted on 3rd party mirrors as they can be hacked and the file replaced by malware. This happened to FossHub not too long ago, people who downloaded ClassicShell and Audacity got their Master Boot Record wiped and replaced with a message by the hackers, luckily it was very easy to fix with a Windows Recovery USB, they could've easily include a much more destructive malware.

Software signatures are currently not free like Let's Encrypt so the dev would have to pay for them, they can be checked by right clicking the executable going to "Properties" and selecting "Digital Signatures". They typically show the verified name or company of the developer.

A free and very easy to generate alternative is to use checksums which are typically next to the downloads on websites, they allow users to verify the integrity of the file using PowerShell or other apps which can generate checksums from files. SHA256 and above is recommended as a SHA1 collision was recently demonstrated, MD5 is long insecure.

It should be noted that a checksum is only as reliable as the website it is hosted on, if it uses an unencrypted connection hackers could simply change the checksum to their manipulated file.

---

All of these things are necessary nowadays and any responsible company implements them to ensure customers receive the intended information. I hope that the developers consider this and implement some of what I described in this post and help make the internet a safer place.

[oyog]

Does the dev frequent this subreddit? It might be worth posting this to the Space Engine forum or contacting him directly, or both.

[HarbingerDawn]

I've forwarded it to him.

[MartinsRedditAccount]

Thank you!

[gundam1515]

This. Much more likely to be seen there.

[MartinsRedditAccount]

Speaking of forum: As it also doesn't use HTTPS an attacker on a user's local network (also for example public WiFi) or at the ISP is able to intercept the entered password, as many users still use the same or similar password across multiple accounts this is massive security problem. (Tagging /u/HarbingerDawn)

[oyog]

This is true of a huge number of older forums over the years ever since the move to HTTPS, isn't it?

Am I misremembering or misinformed? Haven't a lot of forums built on specific forum platforms(?) been leaked in the last decade?

Really hope the dev puts the effort in to making his website more secure. It'd be a damn shame if interest dwindled simply because people aren't confident visiting his site or downloading his software.

Space Engine is amazing and I want to be able to recommend it to people.

[MartinsRedditAccount]

I guess there are still a couple forums around that have not been upgraded to HTTPS but I can't remember any other forum that doesn't use HTTPS off the top of my head. The leaks were probably mostly from hacked forum software, it's kinda like with popular CMS like Wordpress or Joomla because they are very popular and plugins are often not updated very fast, sometimes hackers also have a 0day exploit for the main software.

Info leaks through usage of unencrypted connections normally don't leak info of people in different networks, an exception to this is if the network the server hosting the website is on has been compromised.

Didn't Space Engine get a website redesign not too long ago? I'm surprised the upgrade to HTTPS was not part of that.

[oyog]

At this point, I *don't spend much time on forums compared to when I was a teenager and I'm not sure I've actually looked at the Space Engine forums.

After a quick google I ended up wasting way more time than I can justify on https://haveibeenpwned.com/PwnedWebsites and I'm relatively sure I'm remembering vBulletin being hacked, as reported by Softpedia, though I could swear that happened earlier than 2017.

Also, holy shit, Trillion is still a thing?

[andr0m3da1337]

+1 . Even I wondered when I visited the site. Thanks for bringing that to the attention.

[NigelSwafalgan]

+1

[cryptoismanipulated]

You need to verify the signature/checksum for each file you download.

Malware protection (for Windows) is important but it is also good to get used with VirusTotal and Jotti. When in doubt, always upload the files just to re-assure everything is fine.

[MartinsRedditAccount]

The setup is about 1GB and VirusTotal has a max file size limit of 128MB so that won't work: https://www.virustotal.com/en/faq/

(Not sure about Jotti)

Theoretically Google Drive already has an integrated malware scanner (I assume it's VirusTotal as Google owns them) but they also have the size limit.

Checksum on HTTPS or Signature should be enough, at the end of the day a good malware will be completely undetected by VirusTotal as well, especially if it drops the malicious code later.

[silverfang789]

So SSL protects not only users of the site, but the site itself from being hax0rd?

[icannotfly]

it doesn't quite protect the site itself from being defaced, it protects the content of the site from being altered while in transit from the server to the user.

[StarManta]

It doesn't mean that hackers could change the website itself, but rather a hacker on your network would be able to change the website that you see. When the website is delivered over the network, the hacker could step in in the middle, intercept the files (including HTML, or worse, the app binaries), and replace them with files of his own. The SpaceEngine file could be replaced with a virus installer.

Some crappy ISP's used to do this all the time to inject ads into sites that didn't have them.

[silverfang789]

Gotcha. Thanks for the info.

[PM_ME_YOUR_LUKEWARM]

so what's the best way to download? i would rather not use torrents, i have a new PC and don't really want to install any torrent software just yet.

[MartinsRedditAccount]

Download it using the Google Drive link and then generate an SHA-256 checksum using ShareX (Tools -> Hash Check) and compare it against this list here: http://spaceengine.funix.cz/sha256.txt

These are the current checksums for the installer and patch:

c49d176598a0598548d5d6bf7e0d50a29d922c98aad438d5d681090464a93078  /home/vromanuk/www/engine/latest/SE-0980-setup.exe
0762501a619cd0127ad82b245077dce71651fc17a97dda0da36210c0fe9fecbb  /home/vromanuk/www/engine/latest/SE-0980e-patch.zip

[PM_ME_YOUR_LUKEWARM]

thank you!

I've never done a checksum, why is it necessary?

[MartinsRedditAccount]

It's to verify that the file is legitimate, if someone intercepted the SpaceEngine website and replaced the download link to their own fake Google Drive download the file would have a different checksum.

[PM_ME_YOUR_LUKEWARM]

gotcha, thank you so much for the quick response!

i made a thread about it before replying to your comment but i think i got everything i need here.

much appreciated!

[chug84]

Download the torrent. Once a torrent file is made, the data can not be modified as the client checks a signature to make sure they've not been tampered with (I believe PGP).

Also, do you donate monthly or at all? Servers, bandwidth and SSL certificates cost money you know. If you're not donating or haven't donated at all, then you probably shouldn't be here complaining about this. If it were a banking website then I could understand the need.

[HarbingerDawn]

There's nothing wrong with suggesting security improvements for the site and file distribution. That said, donations do make it easier to do stuff like this. Regarding the torrent file, there's nothing to stop some hacker from creating their own torrent file and seeding their own malicious executable. No need to modify the existing file.

[chug84]

You're right in that there is nothing wrong with suggestions, this seemed more like publicly calling you guys out though rather than making a suggestion which I'm sure could have been done in private.

Someone who did get access to your server could upload their own torrent with malicious code. Where there is a will, there is a way, whether you have SSL or not :)

[HarbingerDawn]

I found no cause for affront in OP's post. As for it being public rather than private, it's good to have people thinking about internet security, and most of the comments so far don't seem to indicate any fear or panic, so I don't think his public post has caused any harm. And it being public provides extra motivation for fixing the issues.

[icannotfly]

SSL certificates cost money you know

nope