As far as I understand, Trackers in torrents somewhat provide the promise that the peers it shows you are non-malicious. In trackerless torrents however, you fetch peers from other peers. How does that system ensure malicious peers are weeded out from the pool and not passed around?
My question stems from the fact that I thought a malicious user would simply give the malicious file to other users and they would accept it. This turns out to be incorrect.
As far as I understand this - it seems like the
.torrent file holds metadata about the SHA1 hash of each file block you will download.
This means that you can have malicious users send you malicious data but the torrent client checks the hash of the sent data and the expected hash. If they don't match - the file is discarded.
Consequently, the trust now depends on the
.torrent file and the place you obtained it from. If it originally contains checksums for a malicious file, you cannot do anything but download the malicious file.
It semes like there is a mechanism in trackerless DHT torrents which eventually weeds out malicious peers, but I do not have access to the paper which describes it - https://link.springer.com/chapter/10.1007/978-3-540-79705-0_4