3 ms·
> An alternate approach would be to use the auto-update features of the terminal and force the app distributors to sign and push a trojan to that specific targe
by hellojesus 3y ago
> An alternate approach would be to use the auto-update features of the terminal and force the app distributors to sign and push a trojan to that specific target.
This is a compelling reason to build from source for e2e messagers. Google's move to signing apks with their own keys helps facilitate the above.
- cornholio 3y agoRealistically speaking, defending against an active attack from your OS distributor targeting you specifically is an exceptionally tall order. It ultimately comes down to obtaining a known safe compiler, building something like a Gentoo stage 1 installation, then manually audit the source of each and every every security patch you apply, knowing that any minor update might actually hide some kind of remotely exploitable back door. You would need NSA-level of resources to pull this off, I doubt the apk signing by Google changes things significantly for Android users.
- hellojesus 3y agoTrue, but don't you think a massive amount of folks would devote time to an open source alternative just to stick it to govs if they tried to pass something like banning unlocked bootloaders? Grapheneos exists with a far smaller potential user base.