News for hackers. Stuff that matters.

A comment on Viber adds end-to-end encryption. Parent comment

Re:Viber adds end-to-end encryption by AJ007 on Tuesday April 19, 2016 @01:25PM (#11528560)
The value is not just the public display of the source code for auditing, but the validation that what you are running was indeed compiled from that code.
[ Parent | on HN ]
Re:Viber adds end-to-end encryption by brianacton on Tuesday April 19, 2016 @08:30PM (#11531539)
This is literally an impossibility. Java apps are typically obfuscated with randomization of symbol names. Each build is unique and not reproducible.

You are better off verifying the actual compiled and distributed apk files than verifying the source.

[ Parent | on HN ]
Re:Viber adds end-to-end encryption by danjoc on Tuesday April 19, 2016 @09:49PM (#11531785)
It's impossible?

https://whispersystems.org/blog/reproducible-android/

[ Parent | on HN ]
Re:Viber adds end-to-end encryption by russell_h on Tuesday April 19, 2016 @02:45PM (#11529188)
Simply open sourcing the code doesn't give that validation.
[ Parent | on HN ]
Re:Viber adds end-to-end encryption by AckSyn on Tuesday April 19, 2016 @06:28PM (#11530993)
Not completely but I can certainly look at it, compile, and then side-load it onto my device knowing it's what it said it was.
[ Parent | on HN ]