Dash is now available on Floyx
(The Social Media Page specific for Blockchain Cryptocurrency Communities)
https://www.floyx.com/profile/dash

Monero's official website got compromised today and was infected with malware designed to steal coins : https://www.zdnet.com/article/official-monero-website-compromised-with-malware-that-steals-funds/

This got me thinking : do Dash users know how to verify the provided hash file that is available with the official Dash downloads ? (to verify if they have downloaded the correct official Dash Core Wallet file ?)
So i wrote this quick hash verification procedure for Dash users that are using Windows 10 Windows 7.

When downloading from the official https://www.dash.org/downloads website, you will often come across this 'Hash File' :

 

After downloading such a 'Hash File', you end up with a SHA256SUMS.asc file. This .asc file can be opened with notepad notepad++
which shows you the hash for each download and which looks like this :



Now lets for example download 'dashcore-0.14.0.3-win64.zip' and verify its hash to make sure that the downloaded file is actually the correct file with a match to hash number '0c3fe9a3658f4b676596154b085793fe6674f4d2c5c6015146f8bcedc883e25a'

For Windows 10 users, i suggest using Windows PowerShell (Admin), which you can find when you right click on the Windows Startbutton. For Windows 7 users i suggest you search
for Windows PowerShell within Windows 7.

Within Windows PowerShell (Admin) use cd to go to your download directory, use ls to list the files in there and then use command CertUtil -hashfile fullfilename* SHA256
* you can select and then copy (ctrl c) and paste (ctrl v) the full filename from within PowerShell  




As you can see the hash of the file i downloaded (dashcore-0.14.0.3-win64.zip), match with the provided hash in the Hash File.
The same can (and should) be done for other files like the Linux x64 file, when you for example need to update your online server masternode.

Since it looks like we will be having a Dash Core Wallet update (v0.14.04) soon, we all will have an excellent opportunity to practice this.

“The percentage of Bitcoin ATM’s supporting any other than Bitcoin cryptocurrencies increased and now it is 70.4%. Dash was the most added coin in October with 194 (17.77% increase) ......" 

https://dailyhodl.com/2019/11/18/global-bitcoin-and-crypto-atms-hit-6000-btc-litecoin-and-ethereum-leading-the-pack/

I agree that hash files should be stored on a separate server, and not on the normal download server (to avoid getting compromised too in case of a hack).
Also I like to point out that Dash also offer both it's binaries and the SHA256SUMS.asc (hash file) on Github .

Link : https://github.com/dashpay/dash/releases (see assets)

I understand there are also ways to verify hash files themselves, by checking who pgp signed them and compare that with developers that have signature rights.
Maybe someone from Dash Core Group can comment on the above ?

I guess we have to wait and see how Monero's official site got compromised in the first place and then check if our own security measurements are still sufficient.
Good to hear that 7zip also has a hash verification tool inside.

Something like this hit another coin I follow. They went after the account without 2fa on github and switched the Windows QT binary, but nothing else. Which is a good reminder for anyone using github make sure to have 2fa setup on top of separate strong passwords on anything important. Dash has some great guides, if they do sign with pgp, is there a guide on how to check the binary against that?

Each binary file has a corresponding signature (.asc) file, SHA256SUMS.asc is a signed list of hashes for all files. Corresponding dev keys to check these signatures can be found on github (the easiest way to verify keys - check the modification/commit date to make sure they were not altered recently) and on keybase. Keys on both resources should match (it's highly unlikely that they would be compromised in both places).

There you go: GPG verification results I get by clicking on dashcore-0.14.0.3-osx.dmg.asc (assuming you have GPG Tools installed and codablock's key imported into it already) on top of Downloads with the binary itself and this signature file on top of Github releases page with both these files lilsted