0

Say I have a website that handles data from another provider/service that my users use. My users log in through OAuth with the foreign provider. They need to add an additional key, which I'll save, which in turn allows me to do all kinds of nasty stuff with their account.

My entire site is (going to be) open-source, without, obviously, API keys and environment variables, like BASE_DIR and the likes of it.

How would I convince my users that the code they use, is exactly the same as the open source one, without any additions whatsoever, so other people who know what's going on can say "Yeah, this code is legit, no worries"? A simple message at the bottom "This code is the exact same as the one found here" can be faked. Most likely everything can be faked - even then, what would be the most trustworthy way? Is there a third party tool that checks the server contents to a GitHub repo?

  • There's no solution to this, short of giving each user SSH access to the server so they can read the code and all your configuration details. – Polynomial Jun 2 '16 at 11:29
  • 3
    @Polynomial Ah, but what if the SSH details provided went to a mirror of the system silently, which doesn't have all the evil things on? You're not being paranoid enough! – Matthew Jun 2 '16 at 11:31
  • @Matthew Well, quite. It's pretty much impossible. – Polynomial Jun 2 '16 at 11:31
  • 2
    "There is nothing more suspicious than someone saying that there is nothing suspicious..." – hamena314 Jun 2 '16 at 14:19
3

You can't, unless the code that runs is entirely client side and interpreted directly from source, in which case they can verify it trivially with standard file comparison tools.

The reason is that you would have to prove that the entire software stack of the system was trustworthy, and that the entire hardware stack was trustworthy, and that every point on the network between your system and the client system was trustworthy. Oh, and that the client system was trustworthy.

Even with a third party system, you could potentially serve different files to that and to users - see this article about detecting the use of Bash pipes for an example of this. You could silently redirect the third party service to a "good" version of your code, whilst sending users the "bad" version, unless they are attempting to download the files for inspection, when you send the "good" version.

You could fake the third party system entirely, and actually control it yourself, claiming that every set of files was identical. You could intercept the response from a third party, changing it so that it appeared to show that all your code was safe. You could do that through malicious code which runs on the client system upon first load, so they never get a true response from the third party system, or just turn off the third party verification so they don't even know about it.

You can't even verify with complete confidence that a compiled application was generated from a specific set of source code, in the general case. See this answer from 2010 for some details on why - it's the same for any other compiled code, so don't be afraid of the VB6 references.

Basically, you have to behave in such a way that they trust that you won't do anything bad, and be prepared that some users won't have that level of trust. There are some people who won't use any software they haven't compiled themselves, on systems they built themselves, using hand written compilers, and even they might fall foul of malicious instructions buried in chips. We went past the point where it is possible to fully verify computer behavior a long time ago (read up on Ken Thompson's evil compiler for an example), and the client-server model doesn't help with that.

On the other hand, most of the time it doesn't matter - people trust systems all the time without this level of reassurance.

  • Great comment, thanks so much. You're right, people do it all the time, which, honestly, frightens me a lot. – Mave Jun 3 '16 at 12:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.