Signal 2.0 released with private messaging support

Post by citruspi » Mon, Mar 02, 2015, 6:56 PM UTC

adrusi wrote: post #8

matt2000 wrote: post #4

One question I always have with secure systems distributed by app stores, even the open source ones, is how to you verify the source you're reading is the app you're using?

Well, there are several ways to get read access to the iPhone's filesystem. You can grab the binary from the phone and verify that its the same as when you compile the app on your own machine. No one's going to do that for most apps though.

Post by maxmouchet » Mon, Mar 02, 2015, 6:56 PM UTC

adrusi wrote: post #8

matt2000 wrote: post #4

One question I always have with secure systems distributed by app stores, even the open source ones, is how to you verify the source you're reading is the app you're using?

Well, there are several ways to get read access to the iPhone's filesystem. You can grab the binary from the phone and verify that its the same as when you compile the app on your own machine. No one's going to do that for most apps though.

Post by jackbravo » Mon, Mar 02, 2015, 7:03 PM UTC

matt2000 wrote: post #4

One question I always have with secure systems distributed by app stores, even the open source ones, is how to you verify the source you're reading is the app you're using?

Post by zokier » Mon, Mar 02, 2015, 7:10 PM UTC

maxmouchet wrote: post #13

adrusi wrote: post #8

Earlier quoted context omitted.

Well, there are several ways to get read access to the iPhone's filesystem. You can grab the binary from the phone and verify that its the same as when you compile the app on your own machine. No one's going to do that for most apps though.

Isn't there chances that different LLVM versions or flags ends up building a slightly different binary ?

Post by zokier » Mon, Mar 02, 2015, 7:16 PM UTC

citruspi wrote: post #11

adrusi wrote: post #8

Earlier quoted context omitted.

Well, there are several ways to get read access to the iPhone's filesystem. You can grab the binary from the phone and verify that its the same as when you compile the app on your own machine. No one's going to do that for most apps though.

So, I'm not intimately familiar with the code signing process, but I imagine that the bundle on the iPhone wouldn't match the one you would get by compiling the source on your machine. The former would be signed with Whisper System's distribution certificate, which you couldn't do on your system because you don't have their certificate.