What is HashDB.net?
The purpose of HashDB is to be a centralized and community-driven repository of file hashes for the purpose of identifying (and verifying) data files systematically. It aims to provide an open-access web service that anyone can utilise for any file identification purposes.
How is this different to file hashing today?
Currently there are two popular methods of file hashing: comparing hash strings and simple file verification (SFV). Whilst these methods are effective at what they do, they can be improved upon.
Comparing hash strings allows users to verify the contents and integrity of a file has not been indeliberately or maliciously changed from its original state. Whilst this is effective for centralised distributions such as a download page on a trusted website, when the distribution becomes (inevitably) decentralized, it is no longer possible to ensure the integrity of files mirrored at other sources since the hash published on other websites may have been tampered with.
In the common event the file is distributed without a hash, users are faced with a difficult process of locating the original or a trustworthy hash (if it exists at all). Furthermore, the process of generating and comparing a hash is prone to human-error and is usually very involved.
Simple file verification on the other hand is an effective method of systematically verifying the integrity of a file, usually automatically performed by an archive software. Whilst SFVs ensure the file's integrity has not been compromised since its checksum were generated, SFVs however cannot be used to help identify (or verify) the contents of files since anyone can manipulate the checksum.
HashDB aims to provide a consistent method of identifying the contents of files (and as a result verifying its integrity) however, wherever and whenever a file may be distributed.
How will it work?
Local clients will generate hashes of files with the SHA-1 hashing algorithm which it sends to the HashDB web service. If a match is located, a descriptor (along with the author of the descriptor and their comments) is returned that has been specified for that file.
If a match has not been located, the user will be given the opportunity to provide the first descriptor of that file.
What happens if an existing descriptor is inaccurate or misleading?
A wiki-style editing control system is implemented to allow registered users to revise descriptors if necessary. The most recent descriptor is preferred.
Other types of users include verified users who through some pre-verification process will allow them to claim hashes and lock hashes from future edits. Guests users will be only able to lookup hashes and not edit them.
Who's evil plan is this?
Get started
The service is free to use, anyone can perform hash lookups.
However if you would like to contribute to the repository by adding or editing descriptors, you will have to create a registered account.