4 ms·

Okay this problem of binary verification you should blame on Google and Andriod app ecosystem. At least on andriod if you install the apk yourself with Telegram

• riquito 12y ago
  > if you install the apk yourself [...] you know exactly what you are running No, you don't. You know what you're running only if you compiled the sources or if you can compare the binary signature with the build of someone you trust (you or others that built from sources).
  • cyphunk 12y ago
    Indeed. Or to go further, you can't trust even compiled sources you place on dev mode device if you didn't also compile the entire OS and drivers. Still, not Telegram/TextSecure's fault
    • riquito 12y ago
      I think that since these programs are all about security, they do have some obligation to distribute securely their binaries, more than a torchlight app. For example I'd be more at ease if the binary distributed by Telegram had the same signature present in a document signed by whoever did the audit (maybe it's even like that, I don't know). Of course I still have to trust my OS, but if the OS is compromised I have utterly lost.
      • cyphunk 12y ago
        The scenario that merits trusting the OS, or app store, is one that assumes you are not individually a target. This means you trust Apple/Google and US/EU. I don't know, I could see there being reason for scenarios that fit this use case but have trouble bringing any to mind other than making fun with crytpo to feel better about yourself, or just muddy the lines for the FBI. If you're an activist, most definitely you fall outside this scenario and shouldn't be using these phones.