BrendanBenshoof

Private keys should be encrypted

14

You could encrypt the entire config file, but by default ipfs should password protect the private key (setup during init process) and not store the private key in the clear...

Blocks are only sanity checked when debug mode is active

25

https://github.com/ipfs/go-ipfs/blob/79360bbd32d8a0b9c5ab633b5a0461d9acd0f477/blocks/blocks.go#L27 This should be checked even if debug is not enabled. Otherwise malicious blocks and merkledag structures could be loaded.