2 ms·
This assumes that everyone gets the same binary, and the binary doesn't get updated. There is no reason that the binary delivered to your phone by the Google Pl
by stubish 7y ago
This assumes that everyone gets the same binary, and the binary doesn't get updated. There is no reason that the binary delivered to your phone by the Google Play Store needs to be the same as the binary delivered to a reporter's phone.
Even if we can trust the binary (and I agree, with Signal as the example we probably can), the application distribution mechanism and the underlying OS and its update mechanisms are still a problem.
- kaoD 7y agoThere are still mechanisms to mitigate reliance on trust. If you truly cared you wouldn't download it from Play Store and you wouldn't use a stock Android ROM. Of course that moves the problem up to the firmware level but the attack space is getting narrower. With G Suite you rely on trust from the ground up.
- pvg 7y agoThere is no reason that the binary delivered to your phone by the Google Play Store needs to be the same as the binary delivered to a reporter's phone. That's moving the goalposts to individual targeting, though. The individual targeting scenario is not that interesting because, as the winged quote from the technical literature goes, "YOU’RE STILL GONNA BE MOSSAD’ED UPON".