How can I verify the PGP signature of https://liteaddress.org on Windows?

Question

Suppose I want to download a copy of https://liteaddress.org in order to run it offline in a safe environment. Then how can I verify that the website hasn't been hacked? How can I verify that the downloaded copy is legitimate and not compromised?

The website explains this:

If you are familiar with PGP you can download this all-in-one HTML page and check that you have an authentic version from the author of this site by matching the SHA256 hash of this HTML with the SHA256 hash available in the signed version history document linked on the footer of this site.

I have just started to read what PGP is because I don't know what PGP and SHA256 hash even are and how they work.

My knowledge of computers is very basic. I mean, I know how to use a computer, but PGP, SHA256, etc. are too technical for me.

Can someone explain to me step by step (assuming my knowledge regarding these topics is zero) how to verify the PGP signature of liteaddress.org?

Answer 1

These steps can be simplified if you use UNIX, as most of the tools are already available. However I assume you use Windows. For PGP explanation, search for videos on youtube.

These steps are for the webpage bitaddress.org.

For the PGP part:
1. Download and install Gpg4win.
2. Go to bitaddress.org and click on the link at the bottom to go to Github Repsitory.
3. On their Github page, click on 'CHANGELOG.txt.asc', then click on the 'raw' tab.
4. Right-click and save as.
5. Run Kleopatra(Gpg4win).
6. Click on Decrypt/Verify tab.
7. Find the CHANGELOG file you just downloaded and 'open'.
8. Now click on the 'search' tab, since you are missing the public key to verify the message.
9. The public key for ninja should have been found, click to import it.
10. Click OK/YES when asked to certify the fingerprints, we know it is the correct ones since the key fingerprint is posted on https://bitcointalk.org/index.php?topic=43496.0 .
11. You will be asked to create a account, click yes.
12. Type whatever you want(not important).
13. Create a simple password.
14. Click 'finish'.
15. Select all the IDs, and then tick the box ' I have verified the fingerprint'and next.
16. Click certify.
17. Enter the password you just created.
18. You will get certification successfull, click finish.
19. Now you will be shown if the contents inside CHANGELOG is valid.
20. If you get "The signature is valid and the certificate's validity is fully trusted." Then we know that the file content is authentic and hasn't been tampered with.
21. So now we know that the file CHANGELOG.txt.asc inside their Github is authentic. We can process to the SHA256 part.

For the SHA256 part:
1. Go to bitaddress.org and right-click and save as 'Webpage HTML only'
2. Download and run QuickHash.
3. In QuickHash go to 'file' tab and select SHA256 as Hash Algorithm.
4. Click 'Select File' and select the html file you just downloaded.
5. A SHA256 HASH value will appear.
6. Now go to bitaddress.org again, and at the bottom of the page click at the link to GitHub Repository.
7. Once in their GitHub, click on the file 'CHANGELOG.txt'.
8 At line 29 you will find "bitaddress.org-v3.3.0-SHA256-dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194.html".
9. Do the "dec17c07685e1870960903d8f58090475b25af946fe95a734f88408cef4aa194" match with the SHA256 you got from QuickHash?
10. If matched, then the HTML you dowloaded is valid and authentic, if not, then something sketchy is going on.