Each time you place an order on Casascius.com, a PGP-signed message containing the payment address will be shown. This allows conscientious customers to be assured that the payment address they are seeing is in fact legitimate, and not a fake address shown by a would-be hacker.
Although I don’t keep bitcoins on my web server, some have rightfully pointed out that an attacker who successfully hacked my site could show an address of his own, and steal funds for single orders. While that’s far better than having a whole wallet compromised, theft of a single order would still be very painful, given the recent rise in BTC price. If you are placing a large order and know how to verify a PGP signature, then you definitely ought to verify the signature before paying.
My PGP key fingerprint ends in F1175A23 and my PGP key can be downloaded from my profile on bitcoin-otc. Each of the PGP-signed addresses I am displaying have been signed in advance – my server is not signing these on-the-fly.
While I’m posting on the topic, I think it’s fair game to point out: we should expect that attacks of this nature can and will happen in the future, and will increase in intensity and cleverness over time. The assumption that any bitcoin address you see on a website is safe to pay is one that will become increasingly unsafe as hackers embrace Bitcoin. Sooner or later, you can expect to see all of the following in the wild (if not already):
- Hacked websites that display the bitcoin address of a thief instead of the real merchant
- Fake invoices (both virtual and mailed) that trick you to paying the address of a thief
- Malware that intercepts and changes the bitcoin address you see on-screen, or which you have copied to the clipboard
I will generally cooperate with any reasonable request to verify that a payment address is in fact mine.