A while back i asked how to avoid the unique identifier / download token that every firefox installation now has when downloading from https://www.mozilla.org/eu/firefox/all/#product-desktop-release As a response you told me to use either of these: What's the difference between archive.mozilla.org and ftp.mozilla.org? Both sites look exactly the same from what i can tell. Also you warned me that downloading from these sites can be insecure because the sites might be vulnerable to "hackers" or might have been "infiltrated" by third partys. What's better getting a unique identifier or downloading from the archive and accepting potential risk? None of this would be necessary if mozilla didn't push a unique identifier. When downloading from the archive the sha512 and sha256 always match the installer, doesn't mean anything if the site itself has been compromised i guess? Then again why would it be compromised? Seriously? I could download the fire installer from the official site and from the archive and compare if both sha512 and sha256 match each other, if so i guess no compromise and no token, right?