Code signing is a mechanism whereby publishers of software and content can use a certificate-based digital signature to verify their identities to users of the code, thus allowing users to decide whether or not to install it based on whether they trust the publisher. Code signing has been touted as a major security feature. But how to use it as an end user?

The advantage of using signed files is that users can know, before they install software programs and active content (such as ActiveX controls) whether the code is trustworthy – but how do you determine that?

Code signing lets you know the origin of the code, and prevents a hacker from distributing “free software” in someone else’s name (for example, putting a malicious program or virus on a Web site for download and claiming that it’s a free tool from Microsoft). In addition to verifying the identity of the publisher, code signing can protect the code from tampering (if the code is changed, the digital signature is invalidated). Thus, code signing provides two security protections:

• Authentication of the author, publisher or distributor of the code
• Integrity of the code itself