News for hackers. Stuff that matters.
Re:Suspicious iOS KeePass Client by mch82 on Sunday May 21, 2023 @10:52AM (#36021541)
Can the binary be attached to the GitHub repo as a release so that the binaries can be compared?
Re:Suspicious iOS KeePass Client by lxgr on Sunday May 21, 2023 @11:55AM (#36022208)
The problem is that the App Store encrypts each binary to a device-specific key for DRM purposes, and it's not possible to disable that.

Additionally, how would you even calculate a binary hash of an iOS app? The filesystem is locked down.

I suppose the OS could provide a way to list binary hashes (either after DRM decryption or for non-DRM-ed binaries, if that ever becomes an option), which would be slightly better if you trust the OS more than the app store, which I personally do (it's much riskier to compromise all devices than to target a single device with modified app binaries).