Even if it's open source, we should say that unless the binary can be reproduced exactly by end user, you can never trust what you are using is actually what you think it is.

Is thst possible, in general? If someone published an open source app to Play, could I compare the Play downloaded app to a local build, and set config appropriately, and get a match?

> Is thst possible, in general?

(Deterministic|reproducible) (compilation|builds) are a fairly recent endeavor; though they're not yet common they are technically feasible. The two efforts I'm aware of are Debian[1] and Chromium[2], though I'm not sure what state they're currently in. From their site, Chromium appears to include Android builds.

There may be Android-specific concerts w.r.t the JVM's JIT, but if you can't trust the onboard runtime, you've already lost IMO.

--

[1] https://wiki.debian.org/ReproducibleBuilds

[2] https://www.chromium.org/developers/testing/isolated-testing...

F-droid[3] is supposedly working on reproducible builds for Android too.

[3] https://f-droid.org/wiki/page/Deterministic,_Reproducible_Bu...

The tor browser bundle and bitcoin use bitcoin's gitian deterministic reproducible build system:

https://github.com/bitcoin/bitcoin/blob/master/doc/gitian-bu...

https://trac.torproject.org/projects/tor/wiki/doc/TorBrowser...

https://blog.torproject.org/blog/deterministic-builds-part-t...

Sometimes? It's been done for TrueCrypt https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie...

People have sniffed the wire for the WhatApp client (on Android, towards another Android) and seen that it is encrypted.

But your point stands - there's no UI to indicate if it was secure or not and the code isn't open so you can't know for sure.

I'm ignorant. How can you prove that it's encrypted in any meaningful fashion vs, say rot13?

We can disprove the existence of strong encryption with a wireshark, but cannot prove it.

Entropy of a rot13 message would be much lower than that of a properly encrypted channel. High entropy is not proof of "meaningful encryption", mind you, since a compressed rot13 or plaintext message would have high entropy too.

Encryption on the transport != end-to-end encryption if you consider the users as the ends. The encryption might very well just be from your device to WhatsApp.

Or it might be like with skype - where according to some report (I don't have link right now, sadly) the encryption is used mostly for obfuscating the protocol and to make building alternative clients harder, but it is give so small entropy pool that it's useless for security.

This code is closed? https://github.com/WhisperSystems/TextSecure

I think that OP refers to Whatsapp?