4 ms·
> no way to check what WhatsApp or iMessage are doing because they're not open source > Reverse engineering is possible, but is tedious I think for a security
by makmanalp 11y ago
> no way to check what WhatsApp or iMessage are doing because they're not open source
> Reverse engineering is possible, but is tedious
I think for a security-related application, trusting that the code you have is the one being built and distributed as binary is a huge oversight. I'd argue that sniffing packets and stepping through code is the proper way (of course having code /does/ help with this) Consider: what idiot would put a backdoor in plain sight?
- nickpsecurity 11y agoThe original commenter specifically mentioned the use-case of building clients from the source. Your comment doesn't counter anything that was said. Btw, most backdoors are disguised as 0-days for corner cases for deniability. They are primarily errors breaking memory safety or side channels. One can also exploit compiler properties but I've never seen that in the wild. Would be easier on iOS, though, due to standardized tools & platform details. So, no, sniffing packets or stepping through code isn't the best way to do it. Best way is combining docs, source code, covert channel analysis, execution traces, and looking at them all for issues. That's still not even minimum requirement for high assurance security but how many problems are caught that exist in low-assurance source & binary distributed software.
- makmanalp 11y agoThe point I'm trying to make is that you can audit some copy of the Telegram source code all you want, you have no idea if that's what's deployed in the app store and thus what's on everyone's phone. So it makes sense to audit what's actually being distributed to end users.
- nickpsecurity 11y agoThat should definitely be audited on top of the source code. You have no disagreement from me, there.