Received-SPF: pass (sog-mx-3.v43.ch3.sourceforge.com: domain of petertodd.org
	designates 62.13.149.81 as permitted sender)
	client-ip=62.13.149.81; envelope-from=pete@petertodd.org;
	helo=outmail149081.authsmtp.net; 
Date: Sat, 22 Mar 2014 14:21:53 -0400
From: Peter Todd <pete@petertodd.org>
To: Mike Hearn <mike@plan99.net>
Message-ID: <20140322182153.GC21728@savin>
References: <CANEZrP0NeDetSLXjtWnCaYYjYcdhsa=ne=a6NJOnvEp8yr7YaA@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="xo44VMWPx7vlQ2+2"
Content-Disposition: inline
In-Reply-To: <CANEZrP0NeDetSLXjtWnCaYYjYcdhsa=ne=a6NJOnvEp8yr7YaA@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Fake PGP key for Gavin
Precedence: list


--xo44VMWPx7vlQ2+2
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Mar 22, 2014 at 06:03:03PM +0100, Mike Hearn wrote:
> In case you didn't see this yet,
>=20
> http://gavintech.blogspot.ch/2014/03/it-aint-me-ive-got-pgp-imposter.html
>=20
> If you're using PGP to verify Bitcoin downloads, it's very important that
> you check you are using the right key. Someone seems to be creating fake
> PGP keys that are used to sign popular pieces of crypto software, probably
> to make a MITM attack (e.g. from an intelligence agency) seem more
> legitimate.

Note that Bitcoin source and binary downloads are protected by both the
PGP WoT and the certificate authority PKI system. The binaries are
hosted on bitcoin.org, which is https and protected by a the PKI system,
and the source code is hosted on github, again, https protected. A MITM
attack would need to compromise the PKI system as well, at least
provided users aren't fooled into downloading over http.

--=20
'peter'[:-1]@petertodd.org
0000000000000000657de91df7a64d25adfd3ff117bc30d00f5aa3065894f4a5

--xo44VMWPx7vlQ2+2
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)

iQGrBAEBCACVBQJTLdS8XhSAAAAAABUAQGJsb2NraGFzaEBiaXRjb2luLm9yZzAw
MDAwMDAwMDAwMDAwMDAzOWRmNTA4OTU3YWI0YTU1YjljZjI5YWM5OGFlYzBiN2Rk
ZTEzMGRhYTViMzMzZjYvFIAAAAAAFQARcGthLWFkZHJlc3NAZ251cGcub3JncGV0
ZUBwZXRlcnRvZC5vcmcACgkQJIFAPaXwkfsPxAgAmBM1+CsyQ6WqDvIYHH6b/1ug
hSUM74wMePOixylhwOHb+y+aaFoSWvQyYbLqGp7IGLVm1LmmjVgJws99vcuBnWeq
GsUSMzMLb1Srkqgjqc1BOw8eIAyrxo5J9TzDOtjY3P8MmMmhXqR+X5pRjCGuCKb+
A6Ay0TDWNH9rXteN4x9DQ/zgVgsKZpKfg496WouPpK8V9YQ2NR7iQbESvtfF/Ian
lue1mE5sw0eTJe3NI5eDgjJYSIs6TOEYEGPg1XtA+x0GGoIOUD6nYHxXc0sA+ix5
19csnghQVBxCMlFd6/6rGxYgY4jHqpei7X9yM70chzbTH3X7gbLupsKzS6Cmcw==
=MyQJ
-----END PGP SIGNATURE-----

--xo44VMWPx7vlQ2+2--