When I connect to my bitcoind instance over RPC, I need a password for that, but no certificate.
So how are man-in-the-middle attacks prevented on that connection?
Add a comment
|
The JSON-RPC interface is intended for local access. By default it will only accept connections from localhost, but it can be configured to be accessed for a wider netmask; e.g. a trusted LAN network.
If you have a need to access it over an untrusted network like the internet, tunnel it through technology specifically designed for that, such as stunnel (SSL) or a VPN. Getting the details of that right and secure is hard, and is considered outside of Bitcoin Core's scope.
For more information, see the documentation.
answered Dec 3 '21 at 15:47
