Why is SHA2 used for file verification if it's susceptible to length extension attacks? Am I misunderstanding length extension attacks, or is there some different reason, or is it really a bad idea to use SHA2 for file verification?

If the answer is that it's really a bad idea, would removing the last 4 bytes be advisable since now the chances of the attack succeeding will be around one in 4 million, and we will have remaining, in the case of SHA512, 480 bits of security?
The use of a hash function for verifying integrity of a file is not impacted by length extension attacks. The setup is the following:


You have a file $m$.
There is a "guaranteed" source for $h(m)$, with $h$ being a hash function. (For instance, you can get $h(m)$ from an HTTPS Web site with verified provenance.)
You recompute $h(m)$ and look for a match.


To make an undetected alteration of the file, the attacker would have to find a message $m'$ distinct from $m$, and such that $h(m) = h(m')$. This would constitute a second-preimage attack. No such attack is currently known on any of the SHA-* functions. The "length extension attack" does not seem to help for second-preimage attacks.

It is interesting to note that the "length extension attack" does not contradict any of the classical properties expected from secure hash functions (i.e. resistance to collisions, preimages and second-preimages).