Re:Google's Abandoned Android Authenticator App
by Someone1234 on Friday February 28, 2020 @02:08PM
(#22445389)
> Finally, I frankly find your claim about open source apps being bad ridiculous.
Nobody called Open Source bad. What got posted was:
> As soon as it is from the app store the "open source" nature is completely irrelevant, it isn't a security guarantee.
Unclear how you got from "no security guarantee [with compiled open source in the app store]" to "open source is bad." Those two things aren't even similar.
The biggest problem with Open Source in the app store is actually automatic updates. It is conceivable to build the app locally and compare the resulting APK to the app store version. But it isn't very realistic to do that every update (or even just follow the repo changes long term).
Most of the time these types of issues aren't important because apps are well sandbox on Android. But in the case of password and two factor managers special consideration has to be taken because the data within the app's sandbox is highly valued, and extrication is trivial with all apps having the default android.permission.INTERNET privilege.
Re:Google's Abandoned Android Authenticator App
by DCKing on Friday February 28, 2020 @02:22PM
(#22445499)
Is railing against uncharitable interpretations of other people your thing today? I'm sorry for summarizing that paragraph so shortly, I don't actually think you think open source is bad.
Nobody called Open Source bad. What got posted was:
> As soon as it is from the app store the "open source" nature is completely irrelevant, it isn't a security guarantee.
Unclear how you got from "no security guarantee [with compiled open source in the app store]" to "open source is bad." Those two things aren't even similar.
The biggest problem with Open Source in the app store is actually automatic updates. It is conceivable to build the app locally and compare the resulting APK to the app store version. But it isn't very realistic to do that every update (or even just follow the repo changes long term).
Most of the time these types of issues aren't important because apps are well sandbox on Android. But in the case of password and two factor managers special consideration has to be taken because the data within the app's sandbox is highly valued, and extrication is trivial with all apps having the default android.permission.INTERNET privilege.