Secure download

Hi,

I am a newbie trying to get my first wallet up. But I have a security/crypto background and so I know enough not to trust a http download. But I don't see any other option to download bitcoin software from sourceforge.

I can check the SHA256 hashes, but how do I verify those?

I am familiar with gpg. Where can I find signatures and the signing keys? Hopefully, the keys are on multiple independent servers.

Or is read-only ssh/sftp/scp access possible?

Thanks in advance,

Chris

My gpg key is on the bitcoin.org homepage: http://bitcoin.org/gavinandresen.asc
.... which you can access securely (and see the history of) at:
  https://github.com/bitcoin/bitcoin.org/blob/master/gavinandresen.asc

If you're really super-duper paranoid, you could also fetch it from the MIT pgp keyserver or look for it in the bitcointalk forums archives.

Import it into pgp/gpg, then you can verify that the download checksums you have are correct with:

gpg --verify SHA256SUMS.asc

All that assuming you're running Linux. If you're Windows or OSX, the latest downloads are code-signed and checked for integrity automatically by Windows/OSX.

On Sat, Mar 02, 2013 at 04:09:38PM -0500, Gavin Andresen wrote:

> My gpg key is on the bitcoin.org homepage: http://bitcoin.org/gavinandresen.asc
> .... which you can access securely (and see the history of) at:
>   https://github.com/bitcoin/bitcoin.org/blob/master/gavinandresen.asc

Would be nice to have a secure page at bitcoin.org, though, rathar than having to go to github - certs from somewhere like Namecheap should cost you next to nothing. For those of us too lazy (not paranoid enough) to bother with GPG, a (secure) page on bitoin.org with the MD5 hashes of the binaries would be awesome...

roy

On Sun, Mar 3, 2013 at 10:54 AM, Roy Badami <roy@gnomon•org•uk> wrote:

> Would be nice to have a secure page at bitcoin.org, though, rathar
> than having to go to github - certs from somewhere like Namecheap
> should cost you next to nothing.  For those of us too lazy (not
> paranoid enough) to bother with GPG, a (secure) page on bitoin.org
> with the MD5 hashes of the binaries would be awesome...

While I think that it's silly that we don't have a HTTPS (only!) page, it should be noted that an HTTPS page is in no way a replacement for GPG, sadly: Anyone who can MITM the server to the whole internet can trivially obtain a fraudulent cert with only moderate cost and time.

(The reason for this is that (many? most? all?) CAs verify authority by having you place a file at some HTTP path on the domain in question. Effectively the current CA model only prevents those from intercepting who cannot intercept the traffic generally. Basically only helps with the evil hotspot/tor_exit problem.)

> (The reason for this is that (many? most? all?) CAs verify authority
> by having you place a file at some HTTP path on the domain in
> question.

IME most CAs verify by emailing hostmaster/webaster@ or one of the contacts in the WHOIS. But you're right, still subject to a MitM. Still better than nothing though.

I would have suggested an EV cert, but that's more expensive (and still far from foolproof)

> Basically only helps with the evil hotspot/tor_exit problem.

Also helps protect against DNS spoofing attacks, but yes, you're right. I should be checking GPG sigs but I'm lazy :-)

roy

> Would be nice to have a secure page at bitcoin.org, though, rathar
> than having to go to github - certs from somewhere like Namecheap
> should cost you next to nothing.

And Namecheap now accept Bitcoin :-)

(Complete coincidence - I didn't know that when I posted)

roy