From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from sog-mx-4.v43.ch3.sourceforge.com ([172.29.43.194] helo=mx.sourceforge.net) by sfs-ml-3.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1UCFTc-0006uZ-AC for bitcoin-development@lists.sourceforge.net; Sun, 03 Mar 2013 20:25:44 +0000 Received: from darla.gnomon.org.uk ([93.93.131.22]) by sog-mx-4.v43.ch3.sourceforge.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.76) id 1UCFTa-00073A-Ln for bitcoin-development@lists.sourceforge.net; Sun, 03 Mar 2013 20:25:44 +0000 Received: from darla.gnomon.org.uk (localhost.gnomon.org.uk [127.0.0.1]) by darla.gnomon.org.uk (8.14.3/8.14.3) with ESMTP id r23KPGoC072254 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT); Sun, 3 Mar 2013 20:25:21 GMT (envelope-from roy@darla.gnomon.org.uk) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.95.3 at darla.gnomon.org.uk Received: (from roy@localhost) by darla.gnomon.org.uk (8.14.3/8.14.1/Submit) id r23KPGLk072253; Sun, 3 Mar 2013 20:25:16 GMT (envelope-from roy) Date: Sun, 3 Mar 2013 20:25:16 +0000 From: Roy Badami To: Gregory Maxwell Message-ID: <20130303202516.GW68379@giles.gnomon.org.uk> References: <5132558A.8040304@recessionstories.net> <20130303185446.GU68379@giles.gnomon.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.20 (2009-06-14) X-Spam-Score: -0.6 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record -0.6 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain X-Headers-End: 1UCFTa-00073A-Ln Cc: g@gnomon.org.uk, bitcoin list Subject: Re: [Bitcoin-development] Secure download X-BeenThere: bitcoin-development@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 03 Mar 2013 20:25:44 -0000 > (The reason for this is that (many? most? all?) CAs verify authority > by having you place a file at some HTTP path on the domain in > question. IME most CAs verify by emailing hostmaster/webaster@ or one of the contacts in the WHOIS. But you're right, still subject to a MitM. Still better than nothing though. I would have suggested an EV cert, but that's more expensive (and still far from foolproof) > Basically only helps with the evil hotspot/tor_exit problem. Also helps protect against DNS spoofing attacks, but yes, you're right. I should be checking GPG sigs but I'm lazy :-) roy