On Sun, Aug 11, 2013 at 4:46 AM, Michael Rogers <[email protected]> wrote: >> The app store can't substitute a different binary (no developer signing >> key), users >> can verify that the app was what the developer produced (via pulling the >> binary and >> checking the hash), and advanced users can verify that what the developer >> produced is what they produce via the replicable build process. > > I don't know how the Apple or Chrome app stores work, but on Android the user > doesn't have a standard way to obtain the developer's key, so the app store > could > sign a modified binary with any key.
Signing isn't sufficient without some means of invalidation under the developer's control. Even putting aside users who are slow to update, select users can be served older versions of apps with known vulnerabilities intact. -- Liberationtech is a public list whose archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at [email protected].
