Comment on Lawsuit Alleges That WhatsApp Has No End-to-End Encryption
protogen420@lemmy.blahaj.zone 13 hours agoabout the 3rd, is the end apk file downloaded by a useer on the playstore reproducible? could google add stuff to the apk before the user downloading it? do users ever bother checking if the apk hash matches the one from the reproducible build?
9bananas@feddit.org 11 hours ago
no, that’s why it’s called fingerprinting:
it’s a kind of mathematical function that takes the entire code as input and outputs a unique result.
the result is just some string of symbols (which really just represent a unique string of 1’s and 0’s).
this unique string of characters is, as mentioned, unique for any given input.
this string can then be compared to any arbitrary other string, and if they match, then you know it’s the same code.
so in the case of signal anybody can download the source, compile it, and verify that it matches the fingerprint of the compiled code on their own device.
that’s why it can’t be faked: you compare the already compiled code.
if even a single digit of the code is out of place, it’s not going to result in the same string, and thus immediately get flagged as a mismatch.
it’s mathematically impossible to fake.
AlfredoJohn@sh.itjust.works 3 hours ago
While I agree with you I did just want to point out one thing.
This:
Is not entirely true persay, every hashing function does have collisions that can occur. But the likely hood that someone baked an exploit in that kept the application functioning while adding their backdoor all the while somehow creating a hash collision with the original fingerprint is practically zero and honestly if someone did pull that off, fucking hats off because that has to be some sort of math and coding wizard beyond most. I should also point out that the file size would most likely/have to be different so there should be other methods of detecting the compromised build regardless.
Sorry I know that was very pedantic of me but I did want to call that out because its technically possible but the actual likely hood has to be so miniscule its almost irrelevant along with the fact that other tells would surely exist.