Quote from: Stephen Gornick on May 02, 2012, 09:28:25 PM

Quote from: Mike3574 on May 02, 2012, 12:43:01 PM

download the blockchain the hard way through the client (which is the safest way after all).

For one thing, your site isn't even SSL capable, so even if you are entirely honest, an attacker could alter the contents of the traffic between you and me, and I could end up downloading a different file than what you are hosting. Each bitcoin blockchain binary from BitcoinCharts gets digitally signed so that the download can be verified as being truly the one built by the site.
- http://eu1.bitcoincharts.com/blockchain/

Using your blockchain binaries means that I am trusting that you haven't injected data that would cause my client to think a transaction was valid, when elsewhere on the network that transaction will be rejected.

Using these is something unsafe, yet for small amounts the convenience might outweight the risk of loss. Just wanted to make sure the risks of use got mentioned here.

I appreciate you bringing these things to my attention. I have inside the zip files the hashes of the individual files contained inside. However, as you said, if someone is able to modify that then it doesn't really matter. I will makes hashes of the actual zip files (which are still on my PC) and add them to the page. Would that solve this problem? Or is there still another way around it for an attacker? Please let me know. I want to do all I can to ensure that nothing is tampered with.

All Best,

Michael

Mike3574

Posts

Merits