4 ms·

in their last point, they forgot that not only can the device be compromised, but app stores can too. You have to trust everyone from hardware manufacturers to

by bsaul 5y ago

in their last point, they forgot that not only can the device be compromised, but app stores can too. You have to trust everyone from hardware manufacturers to software maker to software distribution channel, to not add some form of spying features that would render the e2e algorithm basically useless.

supermatt 5y ago
In theory your app is signed with your (private) key, so it should be tamper resistant from that perspective. Of course, it is those same stores that issue the certs used for "trusted" verification, so they could reissue a new one, resign accordingly and noone would know unless they manually verified the cert with the developer. Maybe that shouldn't be a thing ;)
- bawolff 5y ago
  However the primary selling point of end2end encryption (as opposed to normal encryption) is what if the app creator is evil? But then we end up having to trust the app creator's code anyways.
  - morjom 5y ago
    Wouldn't open-source and/or auditing alleviate this?
    - supermatt 5y ago
      You would need reproducible builds and to manually verify the hash of the respective application bundle. But even then you need to trust the device to actually execute THAT bundle, of course... And even if it did, it could change its behaviour at runtime. Dont forget you are also trusting many layers below the app itself: Hardware design and manufacture, device manufacturers, distributers and vendors, the OS (and the 3rd party libs they depend on) developers and distributers, the underlying application libs, frameworks and runtime, the application notaries and distributers, etc. At any point there could be bugs/vulnerabilities/backdoors/etc.
  - supermatt 5y ago
    My example demonstrates that the app creator doesnt need to be evil. The store can be evil, and for end-user its very difficult to know.
    - bawolff 5y ago
      If apple was evil, i think they would just put a rootkit on your phone. Seems easier and more effective than compromising their app store.
      - supermatt 5y ago
        I mention elsewhere in this thread that there are many layers that can do this sort of attack. Also, this same issue applies on android, where you can have stores not owned by the OS vendor.
sylvain_kerkour 5y ago
Good point thanks! I've updated the conclusion to better reflect that at the end of the day we still have to trust some third-parties, and this is where Open Source comes into play to bring transparency and accountability about what runs on our devices.

by bsaul 5y ago

supermatt 5y ago

In theory your app is signed with your (private) key, so it should be tamper resistant from that perspective. Of course, it is those same stores that issue the certs used for "trusted" verification, so they could reissue a new one, resign accordingly and noone would know unless they manually verified the cert with the developer. Maybe that shouldn't be a thing ;)

bawolff 5y ago
However the primary selling point of end2end encryption (as opposed to normal encryption) is what if the app creator is evil? But then we end up having to trust the app creator's code anyways.
- morjom 5y ago
  Wouldn't open-source and/or auditing alleviate this?
  - supermatt 5y ago
    You would need reproducible builds and to manually verify the hash of the respective application bundle. But even then you need to trust the device to actually execute THAT bundle, of course... And even if it did, it could change its behaviour at runtime. Dont forget you are also trusting many layers below the app itself: Hardware design and manufacture, device manufacturers, distributers and vendors, the OS (and the 3rd party libs they depend on) developers and distributers, the underlying application libs, frameworks and runtime, the application notaries and distributers, etc. At any point there could be bugs/vulnerabilities/backdoors/etc.
- supermatt 5y ago
  My example demonstrates that the app creator doesnt need to be evil. The store can be evil, and for end-user its very difficult to know.
  - bawolff 5y ago
    If apple was evil, i think they would just put a rootkit on your phone. Seems easier and more effective than compromising their app store.
    - supermatt 5y ago
      I mention elsewhere in this thread that there are many layers that can do this sort of attack. Also, this same issue applies on android, where you can have stores not owned by the OS vendor.

sylvain_kerkour 5y ago

Good point thanks! I've updated the conclusion to better reflect that at the end of the day we still have to trust some third-parties, and this is where Open Source comes into play to bring transparency and accountability about what runs on our devices.