0

Today I installed (again) an update for my Ethereum Wallet by downloading a file (Ethereum-Wallet-macosx-0-9-0.dmg) from https://github.com/ethereum/mist, checking it's md5 sum and then just installed it.

But how can I be sure that this version is not tampered with? Both the download source and the md5 hash are published on the same site (github.com) and secured by a single SSL-certificate. As we know the SSL-chain of trust is weak by it's design - ok for everyday transactions but I do not know a single bank which solely depends on SSL when it's customers money is at stake.

Does anyone know a more secure (at least redundant) way of checking if the code I run is released by a trustworthy party?

|improve this question
1

When I'm not in a rush, I download software in advance of when I need it. If the site itself has been compromised, I figure it'll be detected in a few days and appear in the news; in fact, this scenario happened earlier this year/end of last year to a major software package (I thought it was VLC, but it wasn't). Unfortunately, this does not solve a targeted MITM attack.

If you think you're the target of a MITM attack, you can go to various locations (or use a VPN) and try downloading the program, comparing the binary files using a program like diff. This also does not solve the problem where someone has inserted malicious code, but as you've established, most people don't have the time or expertise to audit source code themselves.

If you use an OS that includes a package manager like Debian, you can maybe be more confident that the software installed through it is safe than if you used a website directly. The default software repositories for Debian have signed binaries and code; the developers' signatures were installed when you installed your OS. So unless your OS was compromised or the developer keys were coopted, you should be reasonably safe. But if either of those two cases are true, you've probably got bigger problems than a single software package.

|improve this answer
  • Not a 100% solution - but at least this targets parts of my concern. Thanks! As I do not have a Debian OS at hand: I found a deb-package for Mist on github together with it's md5-hash. So here we have the same problem as with any other OS with no redundancy. If github would get hacked, we would be lost. But do you know, if Debian includes the always latest ethererum-packages in it's default repositories? Honestly I do not think so, as debian is very conservative. – lanti Aug 8 '17 at 7:32
  • As far as I know, neither Debian nor Ubuntu have an Ethereum package in the default repository. Debian is further behind on packages that building Ethereum from source requires, so it's easier in Ubuntu because there's less to update (but it's doable). – lungj Aug 8 '17 at 13:05
0

As it happens more often than not that creators of software == hoster of the download == publisher of the MD5 , the only thing for you to do would take the source from the github repo and build yourself. Because on GitHub, you can trace every change of the code.

It's a noteworthy idea though, to have multiple independent parties provide information on the authenticity of the wallet installer.

|improve this answer
  • Thanks, but installing from source would give an enhanced security only, if I would have checked the code after download line by line. Beside of lacking the necessary skills this is impossible over time. – lanti Aug 6 '17 at 16:21
  • but this is a general issue you would have with absolutely any piece of software you would download. The only option would be having some trusted institution to do that for you, and certify every single new merging of any new line of code, which is, for now, not going to happen. It's either you checking it yourself, or trusting someone to do it. – Nikita Fuchs Aug 6 '17 at 20:55
  • Yes and no: I have to trust the organization who wrote the software - of course (if I do not check it myself). But in this particular case I have to trust also github.com, DigiCert Inc and in my case Apple Inc. who installed the root-certificates on my computer. I would like to see a more direct and redundant trust-path. E.g. if Ethereum would publish the md5-hashes on it's own, github-independent website we would at least not depend solely on the integrity of the github repository. – lanti Aug 8 '17 at 7:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.