1

Suppose I want to download a copy of https://liteaddress.org in order to run it offline in a safe environment. Then how can I verify that the website hasn't been hacked? How can I verify that the downloaded copy is legitimate and not compromised?

The website explains this:

If you are familiar with PGP you can download this all-in-one HTML page and check that you have an authentic version from the author of this site by matching the SHA256 hash of this HTML with the SHA256 hash available in the signed version history document linked on the footer of this site.

I have just started to read what PGP is because I don't know what PGP and SHA256 hash even are and how they work.

My knowledge of computers is very basic. I mean, I know how to use a computer, but PGP, SHA256, etc. are too technical for me.

Can someone explain to me step by step (assuming my knowledge regarding these topics is zero) how to verify the PGP signature of liteaddress.org?

  • Well it seems like the devs haven't updated the SHA256 for liteaddress.org since 2015-01-08, so every commits after that date cannot be verified. – Chak Dec 5 '17 at 21:17
  • @Chak so, does this mean that the PGP signature of liteaddress.org can't be verified? – User X Dec 6 '17 at 18:43
  • 1
    In this case SHA256 of liteaddress.org cannot be authenticated. PGP acts more like a verification of "messages/emails/text". I would say that downloading from their GitHub repository is more safe/secure than download liteaddress.org, either way we wont know if any of them are compromised. However I checked their last commits since 20/07/15, and found nothing malicious. So I will deem their GitHub repository as safe for now, as long it is used offline. – Chak Dec 6 '17 at 19:18
  • @Chak thanks! And what's the difference between PGP and SHA256? And what is "commits"? – User X Dec 6 '17 at 19:51
  • Well is a bit complicated hmmm.... Simply explained SHA256 is mostly used for hashing, while PGP is more an encryption algorithm. SHA256 is designed so that it's (almost)impossible to turn a hash back into its original string. PGP on the other hand can easily be reversed back into its original decrypted form if you have the public key. – Chak Dec 6 '17 at 20:23
1

These steps can be simplified if you use UNIX, as most of the tools are already available. However I assume you use Windows. For PGP explanation, search for videos on youtube.

These steps are for the webpage bitaddress.org.

For the PGP part:
1. Download and install Gpg4win.
2. Go to bitaddress.org and click on the link at the bottom to go to Github Repsitory.
3. On their Github page, click on 'CHANGELOG.txt.asc', then click on the 'raw' tab.
4. Right-click and save as.
5. Run Kleopatra(Gpg4win).
6. Click on Decrypt/Verify tab.
7. Find the CHANGELOG file you just downloaded and 'open'.
8. Now click on the 'search' tab, since you are missing the public key to verify the message.
9. The public key for ninja should have been found, click to import it.
10. Click OK/YES when asked to certify the fingerprints, we know it is the correct ones since the key fingerprint is posted on https://bitcointalk.org/index.php?topic=43496.0 .
11. You will be asked to create a account, click yes.
12. Type whatever you want(not important).
13. Create a simple password.
14. Click 'finish'.
15. Select all the IDs, and then tick the box ' I have verified the fingerprint'and next.
16. Click certify.
17. Enter the password you just created.
18. You will get certification successfull, click finish.
19. Now you will be shown if the contents inside CHANGELOG is valid.
20. If you get "The signature is valid and the certificate's validity is fully trusted." Then we know that the file content is authentic and hasn't been tampered with.
21. So now we know that the file CHANGELOG.txt.asc inside their Github is authentic. We can process to the SHA256 part.

For the SHA256 part:
1. Go to bitaddress.org and right-click and save as 'Webpage HTML only'
2. Download and run QuickHash.
3. In QuickHash go to 'file' tab and select SHA256 as Hash Algorithm.
4. Click 'Select File' and select the html file you just downloaded.
5. A SHA256 HASH value will appear.
6. Now go to bitaddress.org again, and at the bottom of the page click at the link to GitHub Repository.
7. Once in their GitHub, click on the file 'CHANGELOG.txt'.
8 At line 29 you will find "bitaddress.org-v3.3.0-SHA256-dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194.html".
9. Do the "dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194" match with the SHA256 you got from QuickHash?
10. If matched, then the HTML you dowloaded is valid and authentic, if not, then something sketchy is going on.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.