Quote from: pooya87 on August 25, 2019, 03:59:47 AM

...even if you download them from the official website it still is not safe until you cryptographically verify its digital signature. the only thing that you should ever worry about is acquiring the real public key of the developer...as long as PGP is not broken (which it is not) there is no way to fake this...

I agree with you and we should do all we can to inform at least Bitcointalk members about this and educate further on how to use PGP encryption and programs like Kleopatra.
As we all know the most used OS is Windows and this is not so easy to verify signatures on this system for beginners or not tech-savvy people.

To be honest, I have never checked signatures until today. Already downloaded Kleopatra (a couple of times) and started the process (with the help of a how-to tutorial) but always gave up halfway.
I am sure, I have failed every time because is just not easy to set up PGP and I wasn't needed it very badly, for example, to secure all my BTC holdings. In such circumstances, I would do it for sure, no matter how time-consuming and complicated it could be.

This is not the first time we have problems with malicious links to wallets on the web and here on Bitcointalk. I think I have seen already all kinds of wallet hacks: changed links in quotes, changed links in ANN and bounty threads, posting links from hacked accounts, malicious updates and pop-ups, fake redirects, counterfeit signatures, etc. You name it - I have seen it.

Still, I haven't heard about signatures check using PGP, until a couple of months ago, when the problems with Mycelium wallet exploded. I am very long and frequently here on the forum and from what I have seen, everybody was always using VirusTotal, as a reference tool, to check the wallets for viruses and verify them. In all wallets reviews posted here, I have never seen a single PGP signature check to be made.

Sometimes viruses were found by VirusTotal in wallets and I have written about this, to warn other members. I just couldn't believe, that some of them tried to defend these wallets, vouched they were clean and all found viruses are only "false-positive" and totally not harmful Grin

. In the beginning, there were no viruses in wallets at all, even false-positives, but somebody started misinformation (on purpose), wrote a couple of posts, articles, answers about false-positive matches on VirusTotal. This way changed the opinion of enough members, to bring chaos and total misinformation about false-positives virus warnings in the scanned wallets. In my opinion, it was made on purpose and we have missed it on our watch.

I think, the best way to handle this is an informational campaign, to let people know about the need for PGP signature check and how to do it correctly. There is actually no other way, to be relatively safe when downloading something online, as to do the PGP signature check every single time. We should talk about this and keep repeating on every occasion, especially in the Beginners and scam sections. If we start to do it, I am sure, members will create a lot of additional content about PGP (tutorials, translations, guides to Kleopatra, etc) and the word will keep spreading further kinda automatically.