Should I verify the Bitcoin Core release signing keys?Are nodes that don't accept inbound connections necessarily leechers?Is the Testnet stable?Can I retrieve my bitcoins from years ago that I never received?How to verify Bitcoin Core Release Signing KeysRe-insalling Bitcoin Core without re-downloading blockchainUpdating old BitCoin-QT Core client V0.7 - 2017 Approach?reviveing a bitcoin core walletI formated my hard drive with bitcoin core on itHash of backed up wallet file not the same as hash of wallet currently in use
Why does Wonder Woman say "goodbye brother" to Ares?
Is Dom based XSS still a valid security concern in modern browsers?
Impeachment jury tampering
Did Bercow say he would have sent the EU extension-request letter himself, had Johnson not done so?
Why does Thorin tell Bilbo that he has "keen eyes"?
What would be the best propulsion system for this aircraft carrier?
Write a bot to play Grid Game
How would a young girl/boy (about 14) who never gets old survive in the 16th century?
Is exploit-free software possible?
18-month-old kicked out of church nursery
Are the Properties of the EM Spectrum Fluid?
Was this “caterpillar” strategy a good way to advance my pawns?
Multiline Tag command
How to use OpenType Latin Modern Roman in mathrm?
C function to check the validity of a date in DD.MM.YYYY format
Replacing triangulated categories with something better
Why is macOS limited to 1064 processes?
Practical considerations when using a large number of capacitors in parallel?
How did the T-850 still function after it removed its second battery?
Run "cd" command as superuser in Linux
Why does the passage the Letwin amendment "scrap the possibility of a meaningful vote on Johnson's deal"?
How does an aircraft descend without its nose pointing down?
Building a phone charger 500 years ago
Longest unconfirmed transaction?
Should I verify the Bitcoin Core release signing keys?
Are nodes that don't accept inbound connections necessarily leechers?Is the Testnet stable?Can I retrieve my bitcoins from years ago that I never received?How to verify Bitcoin Core Release Signing KeysRe-insalling Bitcoin Core without re-downloading blockchainUpdating old BitCoin-QT Core client V0.7 - 2017 Approach?reviveing a bitcoin core walletI formated my hard drive with bitcoin core on itHash of backed up wallet file not the same as hash of wallet currently in use
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty
margin-bottom:0;
I have been running Bitcoin Core on an old Macbook for about a year, and I updated to v0.18.0 a couple of months ago which I downloaded from bitcoin.org.
I have recently been delving deeper and I realized that I never checked the keys.
Is it recommendable/indispensable?
Can I still check the keys once it is up and running?
Will I have to reinstall and download the entire blockchain again?
bitcoin-core verification
edited Oct 14 at 10:58
Ugam Kamat
4,5401 gold badge7 silver badges30 bronze badges
asked Oct 14 at 10:21
SaidjinnSaidjinn
234 bronze badges
add a comment
|
I have been running Bitcoin Core on an old Macbook for about a year, and I updated to v0.18.0 a couple of months ago which I downloaded from bitcoin.org.
I have recently been delving deeper and I realized that I never checked the keys.
Is it recommendable/indispensable?
Can I still check the keys once it is up and running?
Will I have to reinstall and download the entire blockchain again?
bitcoin-core verification
edited Oct 14 at 10:58
Ugam Kamat
4,5401 gold badge7 silver badges30 bronze badges
asked Oct 14 at 10:21
SaidjinnSaidjinn
234 bronze badges
2
You should check the signature of ALL software you install so that you can trust your computer. Especially if that machine stores the secret key of a loaded Bitcoin wallet.
– mimo
Oct 14 at 19:07
add a comment
|
I have been running Bitcoin Core on an old Macbook for about a year, and I updated to v0.18.0 a couple of months ago which I downloaded from bitcoin.org.
I have recently been delving deeper and I realized that I never checked the keys.
Is it recommendable/indispensable?
Can I still check the keys once it is up and running?
Will I have to reinstall and download the entire blockchain again?
bitcoin-core verification
edited Oct 14 at 10:58
Ugam Kamat
4,5401 gold badge7 silver badges30 bronze badges
asked Oct 14 at 10:21
SaidjinnSaidjinn
234 bronze badges
I have been running Bitcoin Core on an old Macbook for about a year, and I updated to v0.18.0 a couple of months ago which I downloaded from bitcoin.org.
I have recently been delving deeper and I realized that I never checked the keys.
Is it recommendable/indispensable?
Can I still check the keys once it is up and running?
Will I have to reinstall and download the entire blockchain again?
bitcoin-core verification
bitcoin-core verification
edited Oct 14 at 10:58
Ugam Kamat
4,5401 gold badge7 silver badges30 bronze badges
asked Oct 14 at 10:21
SaidjinnSaidjinn
234 bronze badges
edited Oct 14 at 10:58
Ugam Kamat
4,5401 gold badge7 silver badges30 bronze badges
asked Oct 14 at 10:21
SaidjinnSaidjinn
234 bronze badges
edited Oct 14 at 10:58
Ugam Kamat
4,5401 gold badge7 silver badges30 bronze badges
edited Oct 14 at 10:58
Ugam Kamat
4,5401 gold badge7 silver badges30 bronze badges
edited Oct 14 at 10:58
Ugam Kamat
4,5401 gold badge7 silver badges30 bronze badges
4,5401 gold badge7 silver badges30 bronze badges
asked Oct 14 at 10:21
SaidjinnSaidjinn
234 bronze badges
asked Oct 14 at 10:21
SaidjinnSaidjinn
234 bronze badges
asked Oct 14 at 10:21
SaidjinnSaidjinn
234 bronze badges
234 bronze badges
2
You should check the signature of ALL software you install so that you can trust your computer. Especially if that machine stores the secret key of a loaded Bitcoin wallet.
– mimo
Oct 14 at 19:07
add a comment
|
2
You should check the signature of ALL software you install so that you can trust your computer. Especially if that machine stores the secret key of a loaded Bitcoin wallet.
– mimo
Oct 14 at 19:07
2
2
You should check the signature of ALL software you install so that you can trust your computer. Especially if that machine stores the secret key of a loaded Bitcoin wallet.
– mimo
Oct 14 at 19:07
You should check the signature of ALL software you install so that you can trust your computer. Especially if that machine stores the secret key of a loaded Bitcoin wallet.
– mimo
Oct 14 at 19:07
add a comment
|
1 Answer
1
active
oldest
votes
Is it recommendable/indispensable?
Yes, it is a MUST not just recommendable. There are a number of ways in which an attacker could modify the binary that you download from the bitcoin.org website.
- Attacker can compromise the Bitcoin.org website, so any information hosted on that page could be modified by the attacker for its own benefit
- Attacker can compromise the SSL/TSL connection by compromising a Certificate Authority and issuing fake website certificates
- Attacker can launch a man-in-the-middle attack on people visiting the bitcoin.org website and tricking them into believing that they have landed on the original website
Once the attacker has fooled you into downloading a clone of the Bitcoin software with a malicious bug, it could steal all of your coins, use your machine to launch attacks on the Bitcoin network, crash or wipe your computer clean or might place a worm in your machine that acts as a surveillance tool.
In fact, Bitcoin Core developers issued a warning during the release of v0.13.0 binary (in 2016) as they had suspected that the release could be targeted by the state sponsored attackers.
It is also recommended that you verify the signatures and hashes of the binaries from multiple sources and developer signatures. You can use the gitian signature repository to get other signatures and verify multiple signature data through multiple channels.
Can I still check the keys once it is up and running?
You could possibly check the binary once its up and running by evaluating the SHA-256 of the binary in the /usr/bin/bitcoind. But there might be a chance that a malicious code separated from the actual binary during its first execution and now is located in some place you might never find without a thorough forensic analysis.
Will I have to reinstall and download the entire blockchain again?
If you reinstall a new binary and verify it with the signatures, you can just sync it with the network. If the blockchain that you had downloaded from the previous release matches the true version of the Bitcoin blockchain (that is it was not tampered), then you need not download it again.
answered Oct 14 at 10:56
Ugam KamatUgam Kamat
4,5401 gold badge7 silver badges30 bronze badges
Thanks for this detailed answer. I have managed to download and verify v0.18.1. In the process I also realised that I didn't have my port 8333 enabled so now have inbound connections too, so I'm really running a full node. Next I will need help setting up Electrum Personal Server, which I also had trouble with at my first attempt.
– Saidjinn
Oct 14 at 19:39
1
@Saidjinn for accepting incoming connections, you should setlisten=1in thebitcoin.conffile or pass it as a parameter when startingbitcoind. And just to clarify, you are still "running a full node" even if you don't allow incoming connections. You can read more about it here
– Ugam Kamat
Oct 15 at 5:14
add a comment
|
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "308"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/4.0/"u003ecc by-sa 4.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fbitcoin.stackexchange.com%2fquestions%2f91002%2fshould-i-verify-the-bitcoin-core-release-signing-keys%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Is it recommendable/indispensable?
Yes, it is a MUST not just recommendable. There are a number of ways in which an attacker could modify the binary that you download from the bitcoin.org website.
- Attacker can compromise the Bitcoin.org website, so any information hosted on that page could be modified by the attacker for its own benefit
- Attacker can compromise the SSL/TSL connection by compromising a Certificate Authority and issuing fake website certificates
- Attacker can launch a man-in-the-middle attack on people visiting the bitcoin.org website and tricking them into believing that they have landed on the original website
Once the attacker has fooled you into downloading a clone of the Bitcoin software with a malicious bug, it could steal all of your coins, use your machine to launch attacks on the Bitcoin network, crash or wipe your computer clean or might place a worm in your machine that acts as a surveillance tool.
In fact, Bitcoin Core developers issued a warning during the release of v0.13.0 binary (in 2016) as they had suspected that the release could be targeted by the state sponsored attackers.
It is also recommended that you verify the signatures and hashes of the binaries from multiple sources and developer signatures. You can use the gitian signature repository to get other signatures and verify multiple signature data through multiple channels.
Can I still check the keys once it is up and running?
You could possibly check the binary once its up and running by evaluating the SHA-256 of the binary in the /usr/bin/bitcoind. But there might be a chance that a malicious code separated from the actual binary during its first execution and now is located in some place you might never find without a thorough forensic analysis.
Will I have to reinstall and download the entire blockchain again?
If you reinstall a new binary and verify it with the signatures, you can just sync it with the network. If the blockchain that you had downloaded from the previous release matches the true version of the Bitcoin blockchain (that is it was not tampered), then you need not download it again.
answered Oct 14 at 10:56
Ugam KamatUgam Kamat
4,5401 gold badge7 silver badges30 bronze badges
Thanks for this detailed answer. I have managed to download and verify v0.18.1. In the process I also realised that I didn't have my port 8333 enabled so now have inbound connections too, so I'm really running a full node. Next I will need help setting up Electrum Personal Server, which I also had trouble with at my first attempt.
– Saidjinn
Oct 14 at 19:39
1
@Saidjinn for accepting incoming connections, you should setlisten=1in thebitcoin.conffile or pass it as a parameter when startingbitcoind. And just to clarify, you are still "running a full node" even if you don't allow incoming connections. You can read more about it here
– Ugam Kamat
Oct 15 at 5:14
add a comment
|
Is it recommendable/indispensable?
Yes, it is a MUST not just recommendable. There are a number of ways in which an attacker could modify the binary that you download from the bitcoin.org website.
- Attacker can compromise the Bitcoin.org website, so any information hosted on that page could be modified by the attacker for its own benefit
- Attacker can compromise the SSL/TSL connection by compromising a Certificate Authority and issuing fake website certificates
- Attacker can launch a man-in-the-middle attack on people visiting the bitcoin.org website and tricking them into believing that they have landed on the original website
Once the attacker has fooled you into downloading a clone of the Bitcoin software with a malicious bug, it could steal all of your coins, use your machine to launch attacks on the Bitcoin network, crash or wipe your computer clean or might place a worm in your machine that acts as a surveillance tool.
In fact, Bitcoin Core developers issued a warning during the release of v0.13.0 binary (in 2016) as they had suspected that the release could be targeted by the state sponsored attackers.
It is also recommended that you verify the signatures and hashes of the binaries from multiple sources and developer signatures. You can use the gitian signature repository to get other signatures and verify multiple signature data through multiple channels.
Can I still check the keys once it is up and running?
You could possibly check the binary once its up and running by evaluating the SHA-256 of the binary in the /usr/bin/bitcoind. But there might be a chance that a malicious code separated from the actual binary during its first execution and now is located in some place you might never find without a thorough forensic analysis.
Will I have to reinstall and download the entire blockchain again?
If you reinstall a new binary and verify it with the signatures, you can just sync it with the network. If the blockchain that you had downloaded from the previous release matches the true version of the Bitcoin blockchain (that is it was not tampered), then you need not download it again.
answered Oct 14 at 10:56
Ugam KamatUgam Kamat
4,5401 gold badge7 silver badges30 bronze badges
Thanks for this detailed answer. I have managed to download and verify v0.18.1. In the process I also realised that I didn't have my port 8333 enabled so now have inbound connections too, so I'm really running a full node. Next I will need help setting up Electrum Personal Server, which I also had trouble with at my first attempt.
– Saidjinn
Oct 14 at 19:39
1
@Saidjinn for accepting incoming connections, you should setlisten=1in thebitcoin.conffile or pass it as a parameter when startingbitcoind. And just to clarify, you are still "running a full node" even if you don't allow incoming connections. You can read more about it here
– Ugam Kamat
Oct 15 at 5:14
add a comment
|
Is it recommendable/indispensable?
Yes, it is a MUST not just recommendable. There are a number of ways in which an attacker could modify the binary that you download from the bitcoin.org website.
- Attacker can compromise the Bitcoin.org website, so any information hosted on that page could be modified by the attacker for its own benefit
- Attacker can compromise the SSL/TSL connection by compromising a Certificate Authority and issuing fake website certificates
- Attacker can launch a man-in-the-middle attack on people visiting the bitcoin.org website and tricking them into believing that they have landed on the original website
Once the attacker has fooled you into downloading a clone of the Bitcoin software with a malicious bug, it could steal all of your coins, use your machine to launch attacks on the Bitcoin network, crash or wipe your computer clean or might place a worm in your machine that acts as a surveillance tool.
In fact, Bitcoin Core developers issued a warning during the release of v0.13.0 binary (in 2016) as they had suspected that the release could be targeted by the state sponsored attackers.
It is also recommended that you verify the signatures and hashes of the binaries from multiple sources and developer signatures. You can use the gitian signature repository to get other signatures and verify multiple signature data through multiple channels.
Can I still check the keys once it is up and running?
You could possibly check the binary once its up and running by evaluating the SHA-256 of the binary in the /usr/bin/bitcoind. But there might be a chance that a malicious code separated from the actual binary during its first execution and now is located in some place you might never find without a thorough forensic analysis.
Will I have to reinstall and download the entire blockchain again?
If you reinstall a new binary and verify it with the signatures, you can just sync it with the network. If the blockchain that you had downloaded from the previous release matches the true version of the Bitcoin blockchain (that is it was not tampered), then you need not download it again.
answered Oct 14 at 10:56
Ugam KamatUgam Kamat
4,5401 gold badge7 silver badges30 bronze badges
Is it recommendable/indispensable?
Yes, it is a MUST not just recommendable. There are a number of ways in which an attacker could modify the binary that you download from the bitcoin.org website.
- Attacker can compromise the Bitcoin.org website, so any information hosted on that page could be modified by the attacker for its own benefit
- Attacker can compromise the SSL/TSL connection by compromising a Certificate Authority and issuing fake website certificates
- Attacker can launch a man-in-the-middle attack on people visiting the bitcoin.org website and tricking them into believing that they have landed on the original website
Once the attacker has fooled you into downloading a clone of the Bitcoin software with a malicious bug, it could steal all of your coins, use your machine to launch attacks on the Bitcoin network, crash or wipe your computer clean or might place a worm in your machine that acts as a surveillance tool.
In fact, Bitcoin Core developers issued a warning during the release of v0.13.0 binary (in 2016) as they had suspected that the release could be targeted by the state sponsored attackers.
It is also recommended that you verify the signatures and hashes of the binaries from multiple sources and developer signatures. You can use the gitian signature repository to get other signatures and verify multiple signature data through multiple channels.
Can I still check the keys once it is up and running?
You could possibly check the binary once its up and running by evaluating the SHA-256 of the binary in the /usr/bin/bitcoind. But there might be a chance that a malicious code separated from the actual binary during its first execution and now is located in some place you might never find without a thorough forensic analysis.
Will I have to reinstall and download the entire blockchain again?
If you reinstall a new binary and verify it with the signatures, you can just sync it with the network. If the blockchain that you had downloaded from the previous release matches the true version of the Bitcoin blockchain (that is it was not tampered), then you need not download it again.
answered Oct 14 at 10:56
Ugam KamatUgam Kamat
4,5401 gold badge7 silver badges30 bronze badges
answered Oct 14 at 10:56
Ugam KamatUgam Kamat
4,5401 gold badge7 silver badges30 bronze badges
answered Oct 14 at 10:56
Ugam KamatUgam Kamat
4,5401 gold badge7 silver badges30 bronze badges
answered Oct 14 at 10:56
Ugam KamatUgam Kamat
4,5401 gold badge7 silver badges30 bronze badges
4,5401 gold badge7 silver badges30 bronze badges
Thanks for this detailed answer. I have managed to download and verify v0.18.1. In the process I also realised that I didn't have my port 8333 enabled so now have inbound connections too, so I'm really running a full node. Next I will need help setting up Electrum Personal Server, which I also had trouble with at my first attempt.
– Saidjinn
Oct 14 at 19:39
1
@Saidjinn for accepting incoming connections, you should setlisten=1in thebitcoin.conffile or pass it as a parameter when startingbitcoind. And just to clarify, you are still "running a full node" even if you don't allow incoming connections. You can read more about it here
– Ugam Kamat
Oct 15 at 5:14
add a comment
|
Thanks for this detailed answer. I have managed to download and verify v0.18.1. In the process I also realised that I didn't have my port 8333 enabled so now have inbound connections too, so I'm really running a full node. Next I will need help setting up Electrum Personal Server, which I also had trouble with at my first attempt.
– Saidjinn
Oct 14 at 19:39
1
@Saidjinn for accepting incoming connections, you should setlisten=1in thebitcoin.conffile or pass it as a parameter when startingbitcoind. And just to clarify, you are still "running a full node" even if you don't allow incoming connections. You can read more about it here
– Ugam Kamat
Oct 15 at 5:14
Thanks for this detailed answer. I have managed to download and verify v0.18.1. In the process I also realised that I didn't have my port 8333 enabled so now have inbound connections too, so I'm really running a full node. Next I will need help setting up Electrum Personal Server, which I also had trouble with at my first attempt.
– Saidjinn
Oct 14 at 19:39
Thanks for this detailed answer. I have managed to download and verify v0.18.1. In the process I also realised that I didn't have my port 8333 enabled so now have inbound connections too, so I'm really running a full node. Next I will need help setting up Electrum Personal Server, which I also had trouble with at my first attempt.
– Saidjinn
Oct 14 at 19:39
1
1
@Saidjinn for accepting incoming connections, you should set
listen=1 in the bitcoin.conf file or pass it as a parameter when starting bitcoind. And just to clarify, you are still "running a full node" even if you don't allow incoming connections. You can read more about it here– Ugam Kamat
Oct 15 at 5:14
@Saidjinn for accepting incoming connections, you should set
listen=1 in the bitcoin.conf file or pass it as a parameter when starting bitcoind. And just to clarify, you are still "running a full node" even if you don't allow incoming connections. You can read more about it here– Ugam Kamat
Oct 15 at 5:14
add a comment
|
Thanks for contributing an answer to Bitcoin Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fbitcoin.stackexchange.com%2fquestions%2f91002%2fshould-i-verify-the-bitcoin-core-release-signing-keys%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
2
You should check the signature of ALL software you install so that you can trust your computer. Especially if that machine stores the secret key of a loaded Bitcoin wallet.
– mimo
Oct 14 at 19:07