Comment by coinculture

That's right. The first time you sync up, you're particularly vulnerable. You need to authenticate first against a trusted source.