How to upload binary ZIP file to net anonymously?

On Sun, 12 Feb 2017 10:18:25 +0100, Carlos E. R. wrote:

So is the Windows XP Linux-like MD5 checksum
"8735787752b5d652a0ee132fd44c87eb"?

Yes.
You need also to publish the link to the program you used, because there
have been instances of broken implementations.

I'm not sure what a "link to the program I used" means, because the version
I use no longer exists.

If you mean a link to the "current version", that's easy (which was
published originally since I never post a program without a link because
many programs have the same or similar names).

The link to the *current* version of the program is he
App Backup Restore - Transfer, by Apex Apps
https://play.google.com/store/apps/d...life.appbackup

The problem is that the newer versions are far worse than the older
versions, which is why an automagic APK backup is de rigueur for Android!

This is the free version I am happy with:
App Backup & Restore-mobi.infolife.appbackup-53-v3.2.0.apk

On 12 Feb 2017 09:38:55 GMT, Jasen Betts wrote:

I'll ask separately for Android what's a good scanner for malware that
people who download that ZIP file can run to test it for malware.

if they trust you publish a hash, if they doen't trust you there's no
point telling them how to scan it.

I get the point of publishing a hash, which I have done.
That just proves that the web site in the middle didn't change the file
from what it was on my machine.

However, they still need to scan it for malware, since they can't possibly
trust me (I wouldn't trust a stranger on the net - would you?)

On Sun, 12 Feb 2017 16:54:18 +0000 (UTC), Stijn De Jong wrote:

2. A great free app backup and restore utility that I recommend is the
one I use on Android 4.3 Samsung Galaxy S3 is
App Backup & Restore-mobi.infolife.appbackup-53-v3.2.0.apk

3. The current version of that program is he
App Backup Restore - Transfer, by Apex Apps
https://play.google.com/store/apps/d...life.appbackup

4. The checksum of my version of the program is:
C:\ md5sum.exe "App*"
8735787752b5d652a0ee132fd44c87eb *App Backup & Restore-mobi.infolife.appbackup-53-v3.2.0.apk

Apparently, people can also get the older APKs from he
https://www.apk4fun.com/apk/30284/

But I have never used that site, so caveat emptor.

On 2017-02-12 17:54, Stijn De Jong wrote:
On Sun, 12 Feb 2017 10:18:25 +0100, Carlos E. R. wrote:

So is the Windows XP Linux-like MD5 checksum
"8735787752b5d652a0ee132fd44c87eb"?

Yes.
You need also to publish the link to the program you used, because there
have been instances of broken implementations.

I'm not sure what a "link to the program I used" means, because the version
I use no longer exists.

I mean to the checksum app.

--
Cheers,
Carlos E.R.

Carlos E. R. wrote:
On 2017-02-12 15:24, Frank Slootweg wrote:
Stijn De Jong wrote:

I have two Windows questions:
a. How do I get a reliable hash for this file
b. Where can it be uploaded temporarily for this one purpose
(without having to expose who I am on the net)?

IMO, a. and b. are mutually exclusive/incompatible. Why the need for a
checksum if the originator cannot be trusted (because he wants to be
anonymous)?

To verify that a third party has not modified the file, or that is was
not accidentally modified in transit.

In the described scenario, there is no third party. The "accidentally
modified in transit" argument isn't particularly relevant in the given
example - an APK - because an APK is a zip file and hence any corruption
would be detected at unzip time, but yes, in the general file-transfer
case, it could be relevant.

Stijn De Jong wrote:
[...]
7. I don't know how to check that [FS: APK] file, on Android, for
malware or for its checksum though. Do you?

As I menioned in my response to Carlos, for an APK file there's no
need for a checksum to guard against transmission errors, bause a APK
file is a zip file and any corruption will be detected at unzip time..

But if people wanted, they could check it on Windows/Linux, etc..
Maybe there's also an Android app which can do that. Google and the Play
Store are your friends.

And BTW, the 'Info' button of the Windows version of 7-zip gives the
CRC value of a zip file, i.e. hence of the APK. I assume that a zip app
on Android will have similar functionality.

As to a malware check on Android: Why not use a malware checker!? :-)

In article , Frank Slootweg
wrote:

7. I don't know how to check that [FS: APK] file, on Android, for
malware or for its checksum though. Do you?

As I menioned in my response to Carlos, for an APK file there's no
need for a checksum to guard against transmission errors, bause a APK
file is a zip file and any corruption will be detected at unzip time..

that won't detect a modified payload that's been rezipped.

On Sat, 11 Feb 2017 18:26:16 +0000 (UTC), Stijn De Jong
wrote:

Where/how can we upload a binary ZIP file onto the net anonymously?

On the Android newsgroup we have been discussing how some free apps get
worse over time, where a particularly useful app got worse so that the
older version is more desirable than the newer version.
Google Now Launcher to be pulled from the Play Store in Q1 2017
https://groups.google.com/forum/#!to...id/e17_KIXjYKs

The solution to apps changing out from under us is to use a good free app
backup solution, which can retroactively re-create the original installer,
(even if it was a system app or carrier bloatware) and which can
automagically back up all installed apps the moment they are installed.

I use just such one app, but the newer versions are worse than the older
versions so I just want to upload my ZIP file for this one user to use.

The actual app is "App Backup & Restore" which automagically backs up all
installed apps to a ZIP file, which we have found to be "mostly" portable
to other devices.
https://groups.google.com/forum/#!or...s/k0uCMeCYBgAJ

The ZIP file is 3,241KB stored on Windows:
"App Backup & Restore-mobi.infolife.appbackup-53-v3.2.0.apk"

I have two Windows questions:
a. How do I get a reliable hash for this file
b. Where can it be uploaded temporarily for this one purpose
(without having to expose who I am on the net)?

7-ZIP (and Password protect) it and post it to yourself using
a Google account. And forward that mail to whoever needs it.
Google keeps all your stuff for decades. (even if you delete
it).
Why do you need a hash for the file ? 7-zip generates one
automatically....
Still trying to figure out why you need to be anonymous.
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012

On Sun, 12 Feb 2017 03:06:04 +0000 (UTC), Stijn De Jong
wrote:

On Sun, 12 Feb 2017 02:55:51 +0000 (UTC), Stijn De Jong wrote:

Looking about, I see this "copy link" near the top so I click that.
http://i.cubeupload.com/iCPBhQ.jpg

If it worked, this is the link:
http://ge.tt/12S0xli2

As a related aside, is there a way to run a malware scan on this file once
someone downloads it, either from Windows, Android, or Linux?

From Linux or Windows, would that malware scan find an "Android" virus?

Yes. Both Jotti and Virustotal scan for android malware when
they detect an apk file.
[]'s

I'll ask separately for Android what's a good scanner for malware that
people who download that ZIP file can run to test it for malware.
--
Don't be evil - Google 2004
We have a new policy - Google 2012

On Sun, 12 Feb 2017 16:54:20 +0000 (UTC), Stijn De Jong
wrote:

On Sun, 12 Feb 2017 08:36:49 +0000, J. P. Gilliver (John) wrote:

There are I think lots of tools; one I came across recently is Hasher
(http://www.den4b.com/products - scroll down until you find it) which
says it's a "Hashing utility for verifying integrity of files using a
wide range of supported algorithms: CRC32, MD2, MD4, MD5, SHA1, SHA256,
SHA512, RipeMD128, RipeMD160, ED2K." I haven't tried it.

I ended up using
http://www.linuxquestions.org/linux/...sum_in_Windows

Which says this is the executable:
http://www.etree.org/cgi-bin/counter...are/md5sum.exe

I saved that md5sum.exe file next to the APK and ran this:

C:\ md5sum.exe "App*"
8735787752b5d652a0ee132fd44c87eb *App Backup &
Restore-mobi.infolife.appbackup-5
3-v3.2.0.apk

Don't use MD5, they are easily faked. Use SHA 256. Virustotal
won't even allow you to use MD5 as a parameter.
Want to know the SHA256 ? Upload it to Virustotal ....
(I've no idea what apps are available on Android, but
generating hashes on windows XP is trivial. If you are on XP, I'll
point you at some apps)
[]'s
--
Don't be evil - Google 2004
We have a new policy - Google 2012

On Sun, 12 Feb 2017 19:56:12 -0200, Shadow wrote:

Still trying to figure out why you need to be anonymous.

It's the opposite.

Look up Snowden's comments on this because he answered the question more
eloquently than I could.
https://www.google.com/search?q=snow...+privacy+right

"People who say they don't care about privacy because they have got nothing
to hide have not thought too deeply about these issues. What they are
really saying is I do not care about this right. When you say I don't care
about the right to privacy because I have nothing to hide, that is no
different than saying I don't care about freedom of speech because I have
nothing to say or freedom of the press because I have nothing to write."

Basically anyone who asks such a question needs to prove that we have no
right nor need nor desire for privacy before they can even consider asking
such a question.

?People who say they don?t care about privacy because they have got nothing
to hide have not thought too deeply about these issues.?

?What they are really saying is I do not care about this right. When you
say I don?t care about the right to privacy because I have nothing to hide,
that is no different than saying I don?t care about freedom of speech
because I have nothing to say or freedom of the press because I have
nothing to write.?

Privacy is not about something to hide, continued Edward Snowden. It?s
about something to protect. The opposite of privacy is not security: the
absence of privacy is not the presence of security and the presence of
security is not the absence of privacy. Rather the absence of privacy is
the presence of censorship. When you don?t have privacy, when you can?t
speak ideas without the judgement of others, you don?t share those ideas.
You?re a little bit more quiet, you?re a little less free. Privacy is the
right to the self.
? Privacy is the foundation of all other rights. Freedom of speech doesn?t
have much meaning if you can only say what?s popular, without experiencing
some retaliation.

On Sun, 12 Feb 2017 21:37:04 +0100, Carlos E. R. wrote:

I'm not sure what a "link to the program I used" means, because the version
I use no longer exists.

I mean to the checksum app.

Here is the link to the checksum app I used on Windows XP.
http://www.etree.org/cgi-bin/counter...are/md5sum.exe

It would be best to find a checksum for Android though.

Googling, maybe this is useful?
https://play.google.com/store/apps/d...id=com.fab.md5
MD5 Checker, Fabien Thalgott

This recommends "Android File Verifier"
http://www.guidingtech.com/13182/ver...roid-directly/

This says the md5sum is native with busybox
https://forum.xda-developers.com/sho...6#post17065076

On Sun, 12 Feb 2017 19:58:05 -0200, Shadow wrote:

Yes. Both Jotti and Virustotal scan for android malware when
they detect an apk file.

When I search for Jotti, I get only music apps.
https://www.google.com/search?q=jotti+google+play

It's better when I search for Virustotal:
https://play.google.com/store/apps/d...com.virustotal
VirusTotal by VIRUSTOTAL
https://www.virustotal.com/en/docume...-applications/

Here's what it says:
"Please note that VirusTotal for Android does not provide real-time
protection and, so, is no substitute for any antivirus product, just a
second opinion regarding your apps."

This says virus scans are useless though.
https://www.extremetech.com/computin...-to-do-instead

On 2017-02-13 01:23, Stijn De Jong wrote:
On Sun, 12 Feb 2017 19:58:05 -0200, Shadow wrote:

Yes. Both Jotti and Virustotal scan for android malware when
they detect an apk file.

When I search for Jotti, I get only music apps.
https://www.google.com/search?q=jotti+google+play

I understand the answer was for Windows tools scanning for Android
virus. Not Android apps.

--
Cheers,
Carlos E.R.

On 2017-02-13 01:23, Stijn De Jong wrote:
On Sun, 12 Feb 2017 21:37:04 +0100, Carlos E. R. wrote:

I'm not sure what a "link to the program I used" means, because the
version
I use no longer exists.

I mean to the checksum app.

Here is the link to the checksum app I used on Windows XP.
http://www.etree.org/cgi-bin/counter...are/md5sum.exe

I know that. You have to write that for the person that is the target of
that archive you intend to send, not us. You have to post, there, not he

- link to archive
- md5sum
- tool to obtain said checksum (link to original site)

--
Cheers,
Carlos E.R.