In an Bitcoin-related open-source project I'm currently working on (still in early alpha stages), I'll be using a browser extension that verifies the response u

In an Bitcoin-related open-source project I'm currently working on (still in early alpha stages), I'll be using a browser extension that verifies the response using offline signatures (with a way to verify the public key using the Bitcoin network) and compares against builds from the github repository (using travis-ci). Here's some explanation from the website FAQ: #### Browser extension Our browser extension provides improved security by verifying the integrity of the files served by the server. The verification is done using two factors: - **Cold storage signature verification:** In addition to SSL, static files (html/css/javascript) are signed using standard Bitcoin message signatures on an offline machine (the private key was created on that machine, and has no other copies) and appended to the response body as a comment. - **Comparing against the code on GitHub repository:** The source code from the GitHub repository is built on Travis-CI, and the resulting hashes are published publicly on Travis's job page. The extension compares the web server response against those hashes. If a potential attacker gains control over the web server, he still only has access to information the web server already has (which is very little). To get sensitive information, he would have to modify the client-side code to send back more data to the server. For an attacker to succesfully mount such an attack against someone with the browser extension, he would have to: 1. Gain access to the web server 1. Gain access to the personal computer of a developer with commit access to the Github repository 1. Commit his changes to the public GitHub repository, where they can be seen by anyone 1. Gain **physical access** to the offline machine with the private key For users without the extension, he would only have to do the first step. It is highly recommended to install the extension. <a class="btn btn-primary" href="TODO">Install extension</a> #### Public key verification To prevent an attacker from modifying our published Bitcoin public key, its permanently embedded into Bitcoin blockchain in a way that is [nearly impossible](https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_computing_power) to modify (and becomes exponentially more difficult as time goes by). The public key can be verified by taking the following procedure: 1. Take the SHA256 of the domain name ("****.com") 2. Create a Bitcoin address using that hash as the private key 3. Find the **first** transaction with that address as its *output address* 4. The *input address* of that transaction is our public key If its ever required to change the public key, the announcement will be signed with the old public key.