Which E2EE messaging apps other than Signal provide auditable source and reproducible builds? Without those auditing the security of anything distributed by an app store is hopeless.
> Without those auditing the security of anything distributed by an app store is hopeless.
It's not. People have to realise that security is a gradient. Not everyone's enemy is the NSA. Some examples:
* With apps, you can verify that you are running the same build as random people on the Internet. In the browser you can't.
* With apps, you can verify that you are running a build signed by the same entity as random people on the Internet. In the browser you can't, and WhatsApp even has a browser extension just to allow you to check that Cloudflare didn't tamper with the code served by Meta (because obviously you trust Meta but not Cloudflare :-) ).
* You can compile an app from sources. You cannot do that in the browser.
* You can get an open source app that was compiled by someone you trust. You cannot do that in the browser.
> With apps, you can verify that you are running the same build as random people on the Internet
Not on iOS. You can't verify an iOS app at all. You technically could on Android but only by using developer tools and a separate PC.
> With apps, you can verify that you are running a build signed by the same entity as random people on the Internet
On the web every resource is signed with the certificate of the publisher. For all iOS apps and most Android apps you are required to trust the app store in addition to the publisher, which would be analogous to Cloudflare on the web, with the major difference being Cloudflare is optional and app stores are not!
> * You can compile an app from sources. You cannot do that in the browser.
Bullshit. You can absolutely have a reproducible web build that allows auditing that the assets you receive have not been tampered with.
> You can get an open source app that was compiled by someone you trust
Not on iOS, you have to trust Apple didn't modify it. On the web you can verify the certificate of someone you trust and know that what you're downloading is signed by them.
> E2EE is not limited to messaging apps.
So you concede that Signal, and only on Android, is the only messaging app that meets the bar of being auditable. Both web and native are auditable in theory. In reality the "E2EE" native apps people actually use are not any more auditable than browser apps.
> You can absolutely have a reproducible web build that allows auditing that the assets you receive have not been tampered with
What does that even mean? Show me how I can run ProtonMail on my browser today and verify that what my browser is running is the code they have open sourced? Or find me any example where they actually open source the code (not sure Proton does?).
> Not on iOS
So your argument against "web is fundamentally not built to allow that" is "but some app systems are closed"? Are you really trying to argue that "because some app systems are closed, all app systems are closed" or something?
> So you concede that...
Can you please not invent stuff?
> Both web and native are auditable in theory
So we agree somewhere: there are no laws of physics that say web cannot do it. Web is just not built for that, so in practice it's not there.
> In reality the "E2EE" native apps people actually use are not any more auditable than browser apps.
I don't know if you are consciously manipulative or if you don't realise it. My point is that if someone cares about E2EE, they can actually get some level of guarantee with apps. They can't realistically hope to get that with web.
I am not saying "all apps are 100% perfect, secure, auditable, E2EE" or whatever you may want to consider I conceded.
