4 ms·

In theory your app is signed with your (private) key, so it should be tamper resistant from that perspective. Of course, it is those same stores that issue the

In theory your app is signed with your (private) key, so it should be tamper resistant from that perspective. Of course, it is those same stores that issue the certs used for "trusted" verification, so they could reissue a new one, resign accordingly and noone would know unless they manually verified the cert with the developer. Maybe that shouldn't be a thing ;)

bawolff 5y ago
However the primary selling point of end2end encryption (as opposed to normal encryption) is what if the app creator is evil? But then we end up having to trust the app creator's code anyways.
- morjom 5y ago
  Wouldn't open-source and/or auditing alleviate this?
  - supermatt 5y ago
    You would need reproducible builds and to manually verify the hash of the respective application bundle. But even then you need to trust the device to actually execute THAT bundle, of course... And even if it did, it could change its behaviour at runtime. Dont forget you are also trusting many layers below the app itself: Hardware design and manufacture, device manufacturers, distributers and vendors, the OS (and the 3rd party libs they depend on) developers and distributers, the underlying application libs, frameworks and runtime, the application notaries and distributers, etc. At any point there could be bugs/vulnerabilities/backdoors/etc.
- supermatt 5y ago
  My example demonstrates that the app creator doesnt need to be evil. The store can be evil, and for end-user its very difficult to know.
  - bawolff 5y ago
    If apple was evil, i think they would just put a rootkit on your phone. Seems easier and more effective than compromising their app store.
    - supermatt 5y ago
      I mention elsewhere in this thread that there are many layers that can do this sort of attack. Also, this same issue applies on android, where you can have stores not owned by the OS vendor.

bawolff 5y ago

However the primary selling point of end2end encryption (as opposed to normal encryption) is what if the app creator is evil? But then we end up having to trust the app creator's code anyways.

morjom 5y ago
Wouldn't open-source and/or auditing alleviate this?
- supermatt 5y ago
  You would need reproducible builds and to manually verify the hash of the respective application bundle. But even then you need to trust the device to actually execute THAT bundle, of course... And even if it did, it could change its behaviour at runtime. Dont forget you are also trusting many layers below the app itself: Hardware design and manufacture, device manufacturers, distributers and vendors, the OS (and the 3rd party libs they depend on) developers and distributers, the underlying application libs, frameworks and runtime, the application notaries and distributers, etc. At any point there could be bugs/vulnerabilities/backdoors/etc.
supermatt 5y ago
My example demonstrates that the app creator doesnt need to be evil. The store can be evil, and for end-user its very difficult to know.
- bawolff 5y ago
  If apple was evil, i think they would just put a rootkit on your phone. Seems easier and more effective than compromising their app store.
  - supermatt 5y ago
    I mention elsewhere in this thread that there are many layers that can do this sort of attack. Also, this same issue applies on android, where you can have stores not owned by the OS vendor.