<blockquote>
  <p>who has actually verified the code is not malicious in the first place?</p>
</blockquote>

<p>There are many eyes on it from cryptographers, javascript programmers and more.  But there has been no commercial party or individual who claims to have vetted the page to assure that there is nothing malicious.</p>

<p>As far as verifying that the website is serving the same release as the version control repository shows, that can be verified as follow:</p>

<p>Verify that the BitAddress.org website has been updated and returns the same HTML from the commit with the description vx.x in github:</p>

<ul>
<li><a href="https://github.com/pointbiz/bitaddress.org" rel="nofollow">https://github.com/pointbiz/bitaddress.org</a></li>
</ul>

<p>Here's an example of verifying in which the version was v2.4:</p>

<p>First check the sha1sum hash of the html returned by a request to <a href="http://bitaddress.org" rel="nofollow">http://bitaddress.org</a>:</p>

<pre><code>$ wget --quiet -O - http://bitaddress.org|sha1sum
1d5951f6a04dd5a287ac925da4e626870ee58d60  -

$ GET -eSd bitaddress.org|grep -i "200 OK"
GET https://www.bitaddress.org/bitaddress.org-v2.4-SHA1-1d5951f6a04dd5a287ac925da4e626870ee58d60.html --&gt; 200 OK
</code></pre>

<p>Then from my bitaddress.org repo:</p>

<pre><code>$ git checkout master
$ git pull
$ git log --pretty=oneline|grep "v2.4"
eeed4db91edd9eda5eb4277a61aa16ad80bdcdcb v2.4 French translations

$ git checkout eeed4db91edd9eda5eb4277a61aa16ad80bdcdcb
$ git rev-list --max-count=1 HEAD
eeed4db91edd9eda5eb4277a61aa16ad80bdcdcb

$ sha1sum bitaddress.org.html
1d5951f6a04dd5a287ac925da4e626870ee58d60  bitaddress.org.html
</code></pre>

<p>As long as that sh1sum matches the filename and also matches from github, then you can you know have the exact same version as was distributed from github.</p>

CC BY-SA 4.0
2024-02-16T08:32:28.150Z
I don't quite understand this approach. The website mentiones PGP signatures. Should I not import these signatures, verify that the .asc files are from a valid source and generate a SHA256 hash over the HTML file in plain HTML?
Ohumeronen
CC BY-SA 4.0
2024-02-16T10:25:12.947Z
I now read over this post over and over again and searched extensively on the internet. Are you really sure you are correct? Your approach does not use PGP or GPG in any way. The author asks specifically about the verification of a PGP signature. How would I do this when I only calculate SHA1 checksums?
Ohumeronen
CC BY-SA 3.0
2013-04-04T09:49:29.633Z
2013-04-04T09:49:29.633Z
Stephen Gornick
<p><a href="http://bitaddress.org" rel="nofollow noreferrer">bitaddress.org</a> appears to have a versioning system and a PGP signature to confirm the source code hasn't been hacked.</p>

<p>If I save the source code for the page (so I can run it on an offline computer), what steps do I need to take to verify the version I've downloaded matches the signature?</p>

<p>This assumes that the signed version of bitaddress.org is not malicious as answered in <a href="https://bitcoin.stackexchange.com/questions/7973/is-javascript-wallet-generator-available-at-bitaddress-org-relatively-secure">this question</a>.</p>

CC BY-SA 3.0
2013-05-08T09:29:12.460Z
I'd like to propose this question gets reopened. The question proposed as a duplicate doesn't ask for, or offer, a method of verifying the current version of the code. It's just a technicality really, as I do have the answer I want!
Highly Irregular
<signature><bitaddress.org><pgp>
How can I verify the the PGP signature of bitaddress.org?
Highly Irregular
# How can I verify the the PGP signature of bitaddress.org?

(Asked by: username_0 on 2013-04-04)

[bitaddress.org](http://bitaddress.org) appears to have a versioning system and a PGP signature to confirm the source code hasn't been hacked.

If I save the source code for the page (so I can run it on an offline computer), what steps do I need to take to verify the version I've downloaded matches the signature?

This assumes that the signed version of bitaddress.org is not malicious as answered in [this question](https://bitcoin.stackexchange.com/questions/7973/is-javascript-wallet-generator-available-at-bitaddress-org-relatively-secure).

**Tags:** signature, bitaddress.org, pgp

> **Comments:**
> **username_0**: I'd like to propose this question gets reopened. The question proposed as a duplicate doesn't ask for, or offer, a method of verifying the current version of the code. It's just a technicality really, as I do have the answer I want!  

---

## 1 answers

### Answer by username_1 on 2013-04-04. Score: 3 | Accepted answer

who has actually verified the code is not malicious in the first place?

There are many eyes on it from cryptographers, javascript programmers and more.  But there has been no commercial party or individual who claims to have vetted the page to assure that there is nothing malicious.
As far as verifying that the website is serving the same release as the version control repository shows, that can be verified as follow:
Verify that the BitAddress.org website has been updated and returns the same HTML from the commit with the description vx.x in github:

https://github.com/pointbiz/bitaddress.org

Here's an example of verifying in which the version was v2.4:
First check the sha1sum hash of the html returned by a request to http://bitaddress.org:
$ wget --quiet -O - http://bitaddress.org|sha1sum
1d5951f6a04dd5a287ac925da4e626870ee58d60  -

$ GET -eSd bitaddress.org|grep -i "200 OK"
GET https://www.bitaddress.org/bitaddress.org-v2.4-SHA1-1d5951f6a04dd5a287ac925da4e626870ee58d60.html --> 200 OK

Then from my bitaddress.org repo:
$ git checkout master
$ git pull
$ git log --pretty=oneline|grep "v2.4"
eeed4db91edd9eda5eb4277a61aa16ad80bdcdcb v2.4 French translations

$ git checkout eeed4db91edd9eda5eb4277a61aa16ad80bdcdcb
$ git rev-list --max-count=1 HEAD
eeed4db91edd9eda5eb4277a61aa16ad80bdcdcb

$ sha1sum bitaddress.org.html
1d5951f6a04dd5a287ac925da4e626870ee58d60  bitaddress.org.html

As long as that sh1sum matches the filename and also matches from github, then you can you know have the exact same version as was distributed from github.

> **Comments:**
> **username_2**: I don't quite understand this approach. The website mentiones PGP signatures. Should I not import these signatures, verify that the .asc files are from a valid source and generate a SHA256 hash over the HTML file in plain HTML?  
> **username_2**: I now read over this post over and over again and searched extensively on the internet. Are you really sure you are correct? Your approach does not use PGP or GPG in any way. The author asks specifically about the verification of a PGP signature. How would I do this when I only calculate SHA1 checksums?  

---

