Quote from: flyable on August 30, 2012, 08:18:30 AM

The same logic for the paypal email, the bank account...

...implies that PayPal sucks (as if we didn't already know that) and that if your bank sends you sensitive information in emails or allows online banking without HTTPS, then there is something dreadfully wrong with their security and you should withdraw all your money immediately and take it somewhere else... before someone else does. Wink

Quote from: dissipate on August 30, 2012, 08:19:22 AM

In theory, every Bitcoin address received should be encrypted. However, in practice, this probably isn't going to happen. Just as an example, a lot of the sites here: https://en.bitcoin.it/wiki/Donation-accepting_organizations_and_projects have their donation Bitcoin address on an unencrypted web page. If I tried to send a large donation to one of those sites, the Bitcoin address could fairly easily be rewritten upon page load.

You mean signed, not encrypted, but otherwise you are correct. Of course, it's not necessary to use HTTPS for this - GPG and Web of Trust works too, assuming people are diligent about verifying signatures. Though obviously you shouldn't sign your Bitcoin address with itself and think you've done something useful...

Quote from: luv2drnkbr on August 30, 2012, 08:25:31 AM

No, transactions are signed with the private key of the sending address. This can be verified using the public key, ie the sender's address. Any alteration to the plain text would make the signature verification fail. This is standard public key cryptography.

Public key cryptography means that one address can send a message aka a transaction out to the network and everybody can verify that the message has not been altered. So a man in the middle attack could only stop the transaction from being sent out in the network by blocking it (or altering it so it would be rejected and never get in a block). Just changing the sent to address is not possible.

Please re-read the original post. This question has nothing to do with modifying Bitcoin transactions, it is about modifying Bitcoin addresses as they appear on a webpage, before a transaction is made in order to trick users into sending coins to the attacker's address.