Quote from: pooya87 on Today at 02:38:01 AM

Quote from: DaveF on July 12, 2020, 11:22:36 AM

But Coinomi does allow you to change the server it talks to (on the mobile version). Don't trust them for privacy, use your own server.
You can actually install a sniffer on your Wi-Fi and see that yes, once you change it it never talks back to them. On mine it has not pinged back for months except for update checks.

invasion of your privacy doesn't have to happen on every communication. with HD wallets sending the master key (hopefully public not private!!) to their servers would do the trick since they will have all your future addresses and transactions.
and assuming that communication to their servers is encrypted (which it should, using SSL) then you can't "sniff" it anymore. you may just see it communicated which may be to check for updates or may have been sending your information to their servers...

Which is why you should NEVER EVER INSTALL A WALLET ON A PC / LAPTOP / PHONE THAT YOU DO NOT OWN and control.

https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/intercepting-ssl-and-https-traffic-with-mitmproxy-and-sslsplit/

Don't think the company you work for did this? Think again.

There are dozens of other ways to do it too.
So yeah, for the tablet that is in my place that I have funds on I know every call it has made since Christmas.
Never spoke to a node except mine.

But, with that being said since we don't have the source and we don't know what else it's doing, while I am at work today it could send my seed someplace and by the time I get home it's too late.

But, also as I have said if we don't know the way they send updates to the Play / iTunes store it's all moot, more or less:

Code review vs compiled is great but if you don't have auto-update turned off its pointless. The best wallet with the best intentions is worthless if everyone on the team has the ability to push up the files or there is not a good process to do it.

Look a new version, but look the compiled version on github does not match the version in the stores don't update.

How may people auto-updated to the version that EvilDave pushed out Friday afternoon when everyone was leaving for the weekend. Look EvilDave now has 10% of all the BTC stored in everyone's wallet that he took while hopping a flight to a country that has no extradition. How did this happen? Oh, the wallet with all the code reviews and all the proper things done pushes the code to the App / Play store from a PC that is not properly secured.

I have been saying it for a while [and will keep saying it], until all developers give up an audit trail of how their update is secured then offline / hardware for big amounts and be prepared to loose everything from all other wallets at any time.

-Dave