Does Electrum trust servers? Yes it does

[spesmilo]

Does Electrum trust servers? Yes it does

[ecdsa]

that's wrong, servers are not trusted in verifying.
verification uses SPV

[fresheneesz]

@ecdsa Um, yes they are. What are you talking about? Can you please elaborate on why you think the servers aren't trusted in anything? What are the downsides in using SPV vs a full node? You closing this ticket makes me feel extra uncomfortable about using electrum. Don't just shove stuff like this under the rug. Explain it to us or people won't trust you at all

[ecdsa]

github is not a free education tool for end users. it is a bug report system.
we are annoyed when users open issues to ask basic questions.
feel free to use the rest of the internet to learn how Bitcoin and Electrum work.

[ecdsa]

and no, I did not write that servers are not trusted in anything.
I just corrected your statement about verifying.
If you want to learn more, read the docs, do not overload developers with naive questions.

[ecdsa]

if you cannot read, you can also start here: https://www.youtube.com/watch?v=hjYCXOyDy7Y

[fresheneesz]

@ecdsa I'm not asking a question. Let me state something I'm 100% sure about so we can move forward with this issue clearly. One thing Electrum servers are trusted in is that they're trusted not to lie about a transaction not being in a block when an electrum client asks it.

So to make this issue concrete and remove as much contention as possible. Can we please update Electrum's FAQ to say as much? I'll update it myself if you'd accept my pull request.

[ecdsa]

sure, you can always submit a pull request. I will not accept a pull request in advance without having seen it, though.
" trusted not to lie about a transaction not being in a block " is very obscure, you should find a better way to say it.

[fresheneesz]

How about we put it this way: "A compromised Electrum server could never cause your money to be spent without your permission. The most a compromised Electrum server could do is one of the following things:

1. It could tell your client that a transaction has not happened when that transaction has in fact happened
2. It could store the pattern of addresses your client requests information for and use that in ways that could give it information about what addresses are yours / related to you."

How's that? I don't see any evidence that Electrum uses bloom filters, otherwise we could remove point 2.

[fresheneesz]

@ecdsa Can you reopen this so we can keep track of this. Or do you think I should open a new issue with a different title?

[knocte]

@fresheneesz did you end up creating a pull request?

[fresheneesz]

@knocte Nope. @ecdsa didn't respond to my suggestion.

[knocte]

@fresheneesz I think he responded already: create a PR. If what you suggest in the PR is not correct, he will point it out in the PR and you can fix it there.