Johnx wrote:

Please supply GnuPG signatures for executables. Even though the downloaded executable is signed, a man-in-the-middle attack could replace it. The ability to verify using a long lasting GnuPG key solves that problem.

Thanks for your suggestion. WinSCP binaries are signed by long-lasting code-signing certificate.
https://winscp.net/eng/docs/installation#verifying

Thanks for checking @Jacob1! Yes, you're right, they match. Perhaps the hashtool I used didn't use the designated file.

Bug invalid, 2 enhancement requests left. :)

I downloaded the setup package via 2 different Sourceforge mirrors just now - both downloads produced the same hash as listed on the DL page.

Thumbs up for the 2 enhancements requests.

1 bug; 2 enhancement requests

Bug
The download page lists:


The downloaded file has:


Enhancement req. 1:
Please supply GnuPG signatures for executables. Even though the downloaded executable is signed, a man-in-the-middle attack could replace it. The ability to verify using a long lasting GnuPG key solves that problem.

Enhancement req. 2:
Also, you'd do good by removing reCaptcha to register or post. reCaptacha is Google, it's flawed and it only serves Google (get millions of people to work for free for Google by solving one puzzle for their AI project after another, to no end) and it's definitely not private and thus not secure. Please use a local server hosted verification method.