RPC interface MITM protection

Question

When I connect to my bitcoind instance over RPC, I need a password for that, but no certificate.

So how are man-in-the-middle attacks prevented on that connection?

Answer 1

The JSON-RPC interface is intended for local access. By default it will only accept connections from localhost, but it can be configured to be accessed for a wider netmask; e.g. a trusted LAN network.

If you have a need to access it over an untrusted network like the internet, tunnel it through technology specifically designed for that, such as stunnel (SSL) or a VPN. Getting the details of that right and secure is hard, and is considered outside of Bitcoin Core's scope.

For more information, see the documentation.