Some websites publish sha256 to check authenticity of downloaded file.
I suppose this is to protect against man-in-the-middle attack - that my file was not altered during download.
What prevents man-in-the-middle from altering web traffic and fix hash code that I see to match malicious downloaded file ?
Those sites often do not provide SSL, so capturing and fixing HTTP traffic is easy, all it takes is to work with my ISP or some backbone router.
There are even sites that allow to calculate sha256 by uploading file over unsafe HTTP with no SSL - ridiculous isn't it ?
Not only I have to trust that this website does not work for government, I also have to trust my ISP by connecting without SSL.