Quote from: gmaxwell on October 10, 2013, 04:32:22 PM

Quote

- An attacker could hack a computer of one of the bitcoin client developers (Either through direct physical access or through some trojan)
- The attacker could threaten one of the bitcoin developers and such force his to do what he wants

If the system is vulnerable to this, then you can remove the third party "attacker" from the equation: One of the developers could just do this if it were possible. Hopefully, enough people are auditing all changes that this wouldn't be possible.

If someone puts a manipulated client on bitcoin.org with his own source, that is without checking in anything?

Quote from: gmaxwell on October 10, 2013, 04:32:22 PM

Quote

- An attacker could break into the website bitcoin.org and place his malicious client for download, or redirect bitcoin.org via some dns attack to his own (same looking) website
With this attack, the checksum of the client won't be ok but how many users will (or even know how to) check that?

About 1% check. But users update very slowly and we intentionally do not have a forced auto-update. And there are people running automated signature tests who would quickly notice a problem.

If done from a computer of a bitcoin developer, the executable could also be signed valid, so no one will notice the difference.

It would be great some kind of multi key signing would be used, that is, multiple persons have to sign with their private keys to make the signature valid.