4 ms·
Just to be clear though, Messenger is still closed-source, so this all still gets lumped into the "source: trust us" bucket, no?
by anonym29 3y ago
Just to be clear though, Messenger is still closed-source, so this all still gets lumped into the "source: trust us" bucket, no?
- TillE 3y agoThere's no process for verifying that a particular binary is built from known source code, or that the source code lacks any sneaky back doors. The gold standard is and probably always will be analyzing the binary itself, with disassemblers, debuggers, etc.
- gorgoiler 3y agoOr reproducible builds to prove that the app I downloaded from the Apple walled garden matches the one I built myself from this known-good source code.
- gruez 3y agoIt's not even possible to extract the executable without jailbreaking
- eru 3y agoYou wouldn't actually need to extract the executable for reproducible builds to be useful. You could also just have the ability for your phone to reliably tell you the hash of the executable, without giving you the executable itself.
- lxgr 3y agoWhy would you trust the hash function if you don't trust the rest of the platform?
- eru 3y agoThis assumes you trust eg Apple (to a certain degree, eg to have their hardware provide legitimate hashes, but eg not to just run a messaging services), but you want to avoid also having to trust Meta. More generically: you might trust that a company can do the Right Thing now (or at most points in time), but you avoid having to trust that they always do the right thing at all points in time. See how Apple famously could refuse to give law enforcement access to people's phones, because Apple deliberately designed their systems in such a way to remove that ability from their future selves. Similarly, a company that doesn't keep any logs, can't be forced in the future to divulge those logs. They can be forced to start keeping logs, and then be forced to divulge those. But doesn't work retro-actively and is still one extra hoop for the forcing party to jump through. And perhaps you can even set up matters such that adding this vulnerability can't easily be done in private.
- lxgr 3y agoAh, yes, I was mixing up iMessage and Messenger here (too much messaging encryption news these days!) – for the case of trusting your OS and hardware vendor, but not a third-party messenger's vendor, reproducible builds would indeed be advantageous. It's a real shame the app store does not allow for reproducible builds.
- gorgoiler 3y agoThat’s a good point, but in theory only one researcher needs to confirm that an executable from a jailbroken app contains a build that’s consistent (or inconsistent!) with the published source code. We don’t all need to do it.
- gruez 3y agoIn theory they can force apple to serve a backdoored version to a particular region/person, which means one confirmation from a random security researcher isn't enough.
- Madmallard 3y agoYes this is 0% trustworthy
- jchw 3y agoI think practically the best thing you can have is independent audits. Ideally multiple of them, over time. This is the same for open source and proprietary stuff. Otherwise, even if the code is not malicious and not backdoored, there's still no guarantee that it's not accidentally buggy. That doesn't prevent a malicious update from coming around and just sending the entire database wherever, but nothing stops that from say, Element, if you're not actively vetting the updates. The best you can really do is hope that nobody compromises it (or that if somebody does, it gets caught as early as possible). Thankfully it seems like outright compromises to this degree are rare (as far as we know) whether the software is open source are closed source. Basically imo it's a mixed bag. I don't see any obvious way to push the status quo vastly far forward because there's no way to really prove, especially to non-technical users who aren't cryptographers and programmers, that the software is 1. secure 2. doing what it says.
- eru 3y agoIt's slightly better, because lying about this would be securities fraud for the company.
- blitzar 3y agoMy personal security audit is to look at what a company returns when compelled to do so by law enforcement. A passing grade is a block of garbled encrypted mess for which they have no unlock key.
- rapsey 3y agoPretty much all security is trust based. Any product you pick you trust the vendor not to fuck up or be corrupted. You can argue then lets just use open source. Ok but is it that much of a security guarantee? Open source products are of limited functionality. It is great for web servers and frameworks, stuff developers care about. When it comes to feature rich client applications the track record is not nearly as good. Also who is going to pay the server costs?
- Dah00n 3y agoIf there are no security audits by disinterested third parties, then it can clearly not be trusted. If they want trust and can provide it, they likely would have done this. Have they?