I see several sources for binary downloads of the Bitcoin blockchain. Can any of these be used securely?
So far as I know, there's no conceivable attack model if you're going to use the block chain to seed the regular Bitcoin client. It won't accept an invalid block. And it understands that the "longest" block chain wins. So a compromised file that was longer than the official block chain cannot exist, and a compromised file that was shorter would just be rejected as soon as the client connected to the network.
On startup, the client checks to make sure the chain is basically valid and contains the most recent checkpoint.
If there is any attack that works in this way, it's a defect in the client. Because someone could send you the same "broken" blockchain over the network too.
[Update: With the Bitcoin client v0.7, -loadblock= will allow the client to import blockchain data, securely, from a local blockchain archive rather than from the network. The blockchain download from BitcoinCharts.com can be used for this. Copy the blk*.dat from that download to a temporary directory and start Bitcoin-qt -loadblock=temp/blk0001.dat and watch the blocks load fast.]
Going to try to answer the question myself.
Recent copies of the blockchain data files are made available (and digitally signed) by one of the core developers of the Bitcoin.org team.
The URL isn't SSL but there is a digital signature that can be used to verify that the binary downloaded matches.
When using these I am trusting that the developer is honest and has not altered the blockchain. If this developer were to try, invalid data could be injected into the blockchain data file which would then trick my client into verifying transactions that would elsewhere be reject as being invalid.
There is even a slightly older archive of the Blockchain from the Bitcoin Sourceforge distribution site as well:
I now see others providing binary blockchain data as well.
This site doesnt' use SSL nor is it there a digital signature to ensure the download is the same as the one the author hosts.
While these methods aren't generally considered secure, there may be situations where security can be traded off for the convenience. For instance, if you only will be spending previously received coins and not receiving, there is little risk in using one of these blockchain files.
Short answer: If the client checks the blocks it's fine. Clients won't usually do this this and the lack of certainty about database is risky. What attack is possible will depend on client specifics but attacks most likely exist.
You would either have to trust that person and have a data integrity measure or revalidate the downloaded chain yourself. Do remember that the default client treats already downloaded blocks fairly differently from downloaded blocks.
A "low-tech" solution could be to run the bitcoin client twice, one with and one without the downloaded chain. Set them up to connect to eachother. Now one of the two will download & verify the chain locally. Not the most efficient way but it is as trustable as downloading from the web.
Edit: after a discussion with Pieter Wuille I'm sure I'm not sure about how safe downloaded chains are and removed claims towards safety.