Quote from: dermoth on March 10, 2015, 02:03:44 AM

Ok, this last one is really getting me offtopic, but talking about offline features, what I'd like to see is an intuitive way to launch the install on the offline wallet... maybe a signed package that you can extract with Armory? The reason is simple: when I download Armory from the online computer, even with the secure downloaded, how can I trust Armory hasn't been infected with malware so it downloads and validate a malicious version? And if the offline computer is truly offline, then it's still my only choice -- well at least for the common user that never used gpg command-line Wink

The best option is to just learn the gpg command line. On linux it is very easy and only involves two steps. The first is importing the signing key and that only has to be done once. The second is to check the signature of the downloaded file. For an online computer you just need to download the key from MIT key server. The Armory download page has step by step instructions. One security tip to keep in mind is that I intentionally did not include a link or copy of the signing key here. You should go directly to the signer (in this case Armory website) to get the key and fingerprint for the key. If someone tricks you into installing a spoofed key then they can feed you malware which is signed by that key.

The Armory download page covers gpg verification for an online computer. An offline computer is similar but you will need to download the key and then manually copy it to the offline machine and import.

Code:

gpg --recv-keys --keyserver keyserver.ubuntu.com 98832223
# We can't use this command because our offline computer can't reach the keyserver

# So we use the import command and provide it the file containing the Armory public key
gpg --import publickeyfilename.key

Even if your believe your online machine is infected you could use a second online machine (like a smartphone) to verify the key fingerprint shown on the offline machine when you verify the file matches what is shown on the MIT pgp key server and/or armory website.

If you absolutely refuse to learn GPG and trust that the Armory website isn't compromised then from the offline computer you can compare the hash of the file on your offline computer to what is shown on the armory website. Using GPG signature is prefered because if the Armory website is compromised then the attacker can spoof the hashes. Use the sha256sum command to get the hash of the deb package on your offline computer. Compare the hash provided to the hash shown on the Armory website (on download page "signed hash file"). If you are super paranoid check the armory website from a second computer (like a smartphone).

Code:

sha256sum armory_0.93_ubuntu-64bit.deb
c5eeaecbbd07e01593eac1d8945ab49d204547ae3f228d2b0962678e853fb919

You will notice this matches the hash listed on the Armory website. So from an offline computer if you got this result then you can be confident this is a bit for bit copy of what was signed by the Armory devs as long as you trust that the Armory website has not been compromised or you are not subject to a MITM attack.