Is Electrum auto-update ok?

[nrm4bits]

Hello,

I've been using electrum for a while and this is the first time I see something like the picture attached. I don't know if that's normal or just fishing. Just in case I would like to report it here because a guy was scammed with the same strategy.

https://imgbox.es/image/0kN8o

Below the node list my wallet was connected to

https://imgbox.es/image/0kXUa

[1714955490]

1714955490

[1714955490]

1714955490

[1714955490]

1714955490

[1714955490]

1714955490

[ranochigo]

I assume you're talking about the text beside the network bubble on the bottom right? Your image hosting service is blocking me from accessing it.

If so, then you're fine. The dialog is opened from the "Check for update" tab. Of course, I cannot emphasis this enough; always validate your download before doing anything with it. Make sure to go to the correct website.

The relevant UI code is here: https://github.com/spesmilo/electrum/blob/ea3e3ddbb8280f499bf2535d2a8a63dd174e2e44/electrum/gui/qt/main_window.py#L294.

[nrm4bits]

I guess you're right, it's in the bottom right, at the left of the lock icon.

I just talked with the scammed guy (it was several weeks ago), the modus operandi was the same (I am not saying my case is a scam, I will never download from anywhere outside the official site), this guy was lead to a different site and after the "update" his satoshis were gone. Also to note here at that time there were not even an official update.

[ranochigo]

I guess you're right, it's in the bottom right, at the left of the lock icon.

I just talked with the scammed guy (it was several weeks ago), the modus operandi was the same (I am not saying my case is a scam, I will never download from anywhere outside the official site), this guy was lead to a different site and after the "update" his satoshis were gone. Also to note here at that time there were not even an official update.

It was quite a huge issue with the earlier versions of Electrum, namely 3.3.3 and below. The issue in question is the server using the dialog box to masquerade as an official update. As usual, it is easily preventable with a validation of the download itself.