When thinking about which messaging solution to use on my new "smart"phone I reflexively tended towards open source products, figuring that I could trust these more to actually provide the security they promise.
Now that I have decided which to use and installed the app from an app store, I have been asking myself: even if I had checked the source code (I'll admit I have just been assuming that someone did), how could I know that that is what I installed?
I see at least two potential attack vectors:
- The app provider can ship different code than what they publish (e.g. via Github).
- The app store owner (i.e. Google, Apple, ...) can change the shipped code.
I estimate that as little as one or two extra (or missing) lines can render even the most solid setup completely open to attack without the user being the wiser.
So, is there a way (preferably an automated one) to verify that the
apk I downloaded from the app store matches the code I can see elsewhere?