-2

Suppose I have a program like Google Drive, which can scan my local disk and send information outside by SSL/TLS.

How can I be sure such application is not malicious?

2 Answers 2

1

You cannot. You either trust the application developer, or don't install it.

Inspecting traffic will not be much helpful, because you would have to intercept traffic when private information is in transit, and identify the information. The leak could be further encrypted, so you probably wouldn't notice.

Not only this, but you would have to trust the application developer now and forever. Or scan every single update, inspect every packet, keep the application on a sandbox and log every single file access.

0

Without decrypting the traffic and doing analysis of all of the data in each packet, I can't think of any way. Since you can't do that without having the private key - which I can pretty much guarantee you won't get - I don't think you'll have much luck.

1
  • Not enough for an single answer. But basically as addition you need trust. If it's such an worldwide company such as Google you can mostly trust it wont infect your pc with malicious viruses (excluding backdoor or decrypt possibilities). The content of the informations they gather and send however is a different story. You can't be sure what they really are harvesting but again have to trust or don't use the service. A privacy friendly solution would be building your own cloud drive with an nas and owncloud or other software to make it available for you from everywhere.
    – Nico
    Sep 5, 2018 at 11:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .