3 ms·

> You can see their server and client code here: https://github.com/bitwarden https://github.com/bitwarden But in the case of the mobile apps, downloaded from

by pch00 4y ago

> You can see their server and client code here: https://github.com/bitwarden https://github.com/bitwarden But in the case of the mobile apps, downloaded from their respective platform's app store, how can you guarantee the code you see on github is the exact same code you're running on your device? Admittedly this supply-chain-verification is an issue for all mobile app store apps but seems particularly important with something like a password manager.

ionspin 4y ago
In a perfect scenario you would be able to use a reproducible build [0], for Android you can actually get Bitwarden from F-Droid [1] which uses those reproducible builds. For Google play store, there was also that developers needed to sign their apps before releasing to stores, so you knew that it came from developer, but Google removed that when they introduced app bundles. There is still a way to verify if the build is the same as developer provided, but automatic protections that were there are now gone [2] [0] https://en.wikipedia.org/wiki/Reproducible_builds https://en.wikipedia.org/wiki/Reproducible_builds [1] https://mobileapp.bitwarden.com/fdroid/ https://mobileapp.bitwarden.com/fdroid/ [2] https://arstechnica.com/gadgets/2021/07/google-play-dumps-apks-for-the-more-google-controlled-android-app-bundle/ https://arstechnica.com/gadgets/2021/07/google-play-dumps-ap...
- mook 4y ago
  Looking at that, it doesn't seem like you can actually get Bitwarden from F-Droid? That looks like instructions to set up a third-party repository (hosted by Bitwarden)? The page didn't mention anything about reproducible builds. (Doesn't mean they aren't using it though, but that would be internal.)
  - ionspin 4y ago
    You are completely right, this is hosted by Bitwarden so in the end you would be better of building from source yourself.
hoistbypetard 4y ago
Short of building the client yourself, I don't believe it's practical to verify that. I haven't been willing to take it that far yet, though that appeals to me.

by pch00 4y ago

ionspin 4y ago

In a perfect scenario you would be able to use a reproducible build [0], for Android you can actually get Bitwarden from F-Droid [1] which uses those reproducible builds. For Google play store, there was also that developers needed to sign their apps before releasing to stores, so you knew that it came from developer, but Google removed that when they introduced app bundles. There is still a way to verify if the build is the same as developer provided, but automatic protections that were there are now gone [2] [0] https://en.wikipedia.org/wiki/Reproducible_builds https://en.wikipedia.org/wiki/Reproducible_builds [1] https://mobileapp.bitwarden.com/fdroid/ https://mobileapp.bitwarden.com/fdroid/ [2] https://arstechnica.com/gadgets/2021/07/google-play-dumps-apks-for-the-more-google-controlled-android-app-bundle/ https://arstechnica.com/gadgets/2021/07/google-play-dumps-ap...

mook 4y ago
Looking at that, it doesn't seem like you can actually get Bitwarden from F-Droid? That looks like instructions to set up a third-party repository (hosted by Bitwarden)? The page didn't mention anything about reproducible builds. (Doesn't mean they aren't using it though, but that would be internal.)
- ionspin 4y ago
  You are completely right, this is hosted by Bitwarden so in the end you would be better of building from source yourself.

hoistbypetard 4y ago

Short of building the client yourself, I don't believe it's practical to verify that. I haven't been willing to take it that far yet, though that appeals to me.