Date: Sun, 3 Mar 2013 20:25:16 +0000
From: Roy Badami <roy@gnomon.org.uk>
To: Gregory Maxwell <gmaxwell@gmail.com>
Message-ID: <20130303202516.GW68379@giles.gnomon.org.uk>
References: <5132558A.8040304@recessionstories.net>
	<CABsx9T2yka9vHVttyzTuAEdHtmQSCyAPnJsh1EiwBNoiC24fSg@mail.gmail.com>
	<20130303185446.GU68379@giles.gnomon.org.uk>
	<CAAS2fgSRYcC4e0E5UiXnLUYZHOkRkvgVdRnmOBWfqcXEKdkgFQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CAAS2fgSRYcC4e0E5UiXnLUYZHOkRkvgVdRnmOBWfqcXEKdkgFQ@mail.gmail.com>
User-Agent: Mutt/1.5.20 (2009-06-14)
Cc: g@gnomon.org.uk, bitcoin list <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Secure download
Precedence: list

> (The reason for this is that (many? most? all?) CAs verify authority
> by having you place a file at some HTTP path on the domain in
> question.

IME most CAs verify by emailing hostmaster/webaster@ or one of the
contacts in the WHOIS.  But you're right, still subject to a MitM.
Still better than nothing though.

I would have suggested an EV cert, but that's more expensive (and
still far from foolproof)

> Basically only helps with the evil hotspot/tor_exit problem.

Also helps protect against DNS spoofing attacks, but yes, you're
right.  I should be checking GPG sigs but I'm lazy :-)

roy