Quote from: DaveF on Today at 12:39:52 PM

I know I have said it before and will keep saying it about open source wallets or anything. Unless you compile it yourself OR make sure that any auto-updating is turned off you are probably getting a false sense of security. Unless they can prove an audit of their update security.

I agree. My approach on that (not sure if I shared it here in this thread) is a monitoring app that can pull the plug (switch phone offline). This feature could maybe be added to the wallet itself with less than 100 lines of code, to make sure the wallet becomes less of a target for hackers as pulling the plug would happen for all users, not only those that run an extra app if something weird is detected but for a start it also works as a separate app. That app would detect every install of a relevant app (enlisted Bitcoin wallets) and check the fingerprint with ideally more than one independent server. If the hash is unknown, upload the apk and go offline. If the server finds the apk to be a non-white-listed release, signed with the provider's keys, it triggers an alert. All that run the app get their phones switched offline (or otherwise updates disabled) and a notification shown. For this to work, the provider has to publish their soon to be releases, reproducible binaries (maybe without signature if they don't want users to update to it just yet) for white-listing.

Quote from: DaveF on Today at 12:39:52 PM

Having a code audit and being open source is good. But it the machine that uploads the files to the play store / itunes is not secure then it all goes out the window.

The machine or the machine's administrator. Under duress, who knows what would happen?

Quote from: DaveF on Today at 12:39:52 PM

Employee "Dave" goes evil. Owner / programmer "giszmo" does everything properly, open source, code audits, etc.
3:30 PM on Friday Dave uploads the bad wallets to the online stores. They have nothing to do with the GitHub code. Says to giszmo "See you Monday" as always and walks out the door.
3:45 PM stores start pushing out bad version
4:00 PM Dave arrives at airport
10:30 PM Dave lands in some tropical island
11:45 PM Dave checks and 500 copies of the wallet have been downloaded and have ~ 35BTC in total.
6:00AM Sat 7200 copies have been downloaded and have ~90BTC in total.
Dave sits and wait's till there are 100+ BTC in the compromised wallets. And then hits the "Send to Dave" button.
Will probably get some more BTC till everyone figures out what is wrong and happening.

Is there any reason to press the button before he sees an update of the app on Google/Apple or his credentials revoked? I don't think so. He can probably keep pretending for a week or two.

Quote from: DaveF on Today at 12:39:52 PM

So is that better then a closed souse wallet that needs 3 checks against their internal code before it's uploaded and the uploads needs 2 different 2fa devices that 2 different people have?

Tell me who has that setup? I have yet to find a project that would even claim to do reproducible builds of their closed source product. Without reproducible builds, people sign off blindly.

Quote from: DaveF on Today at 12:39:52 PM

I like open source, I use open source, unless everything has multiple separate checks in the process it's not any better some times.

It signals but the open source community also helps fix issues at times. Mycelium got several issues fixed thanks to outside contributions.

Quote from: DaveF on Today at 12:39:52 PM

Sorry, but I am going to keep saying that. And that the above rant or a similar one should be on every page that discussed the benefits of open source.

Public Source doesn't proof security. It only can make it painfully obvious if the app lacks security. Any app that cannot be deterministically built cannot avoid a single point of failure. A closed source app skips that scrutiny and has less of an incentive do do things right. Without really technical people demanding it, managers let it slip down in priority until "Dave" actually pulls it off and goes on prolonged vacation. (You actually got your cast wrong. It's Eve who goes on vacation Wink

)