Quote from: bitmagi on January 04, 2014, 08:18:45 PM

I know you are probably doing this with good intentions, but it seems a lot of people are putting a lot of trust in these kind of products without thinking about the security possibilities.

If I wanted to steal some bitcoin this would be a fantastic way to do it. I could modify the armory source to stash any PKs loaded to an obscure location on the SD card. I could then modify one of the standard linux daemons to wait for an internet connection and then send the contents of this obscure PK file to myself. I know that this is theoretically an offline wallet but I can see many people in a moment of weakness establishing an internet connection just long enough to download and install one of their favorite apps that doesn't come in your bundle.

Again, I doubt this is the case, but people really shouldn't be running software on anything that they haven't personally verified the source/binaries. When setting up an environment verify the OS, the bitcoin client and any other tools that you will need. There isn't any way to do that with this, a whole lot of blind faith in an anonymous entity is required.

Indeed it is possible for me to steal coins from users who choose to use my compiled Armory version, however it is extremely difficult for me to do that, and impossible if you actually follow my own instructions (which is to NEVER connect the Pi to the internet).

By the way, if anyone is interested in adding something to the bundle, he can do it via USB instead of connecting the device to the internet which is quite convenient even compared to directly plugging the Pi to the internet.