Timeline for How to verify iOS app integrity?

Current License: CC BY-SA 3.0

18 events
when toggle format what by license comment
Sep 2 '16 at 18:08 comment added D.W. See github.com/WhisperSystems/Signal-iOS/issues/641 for extensive discussion of how ot achieve this and what the hurdles are.
Aug 20 '13 at 1:19 answer xuinkrbin. timeline score: 1
Aug 20 '13 at 1:16 comment added xuinkrbin. @DavidDelMonte: Very insightful.
Aug 20 '13 at 0:24 comment added ICL1901 You will have access to your codebase while the app is in the store. You can periodically push updates, and you can use the logs to check and deliver key messages. nth
Aug 19 '13 at 21:14 comment added Kevin Apple doesn't need a keylogger to intercept the keystrokes, it controls the keyboard that tells you what the user is typing in the first place. Even if you were to write a custom keyboard, Apple's code is what is displaying it on the screen and telling you when and where the user tapped. All user interaction on an iDevice goes through Apple's code, period. If they want to intercept any data, they can and there's nothing you can do about it. Want to send or receive data from the server? Apple controls the network stack. Want to read or write to disk? Apple controls file i/o too.
Aug 19 '13 at 21:05 comment added xuinkrbin. @tubedogg: You may have a point there.
Aug 19 '13 at 21:04 comment added xuinkrbin. @Kevin: I would appreciate greatly if you would work your comments in a more diplomatic and less presumptive sounding fashion, this being the Internet and all, whether or not You are right and especially if You are wrong.
Aug 19 '13 at 21:01 history undeleted xuinkrbin.
Aug 19 '13 at 20:42 history deleted xuinkrbin. via Vote
Aug 19 '13 at 20:41 comment added Kevin @xuinkrbin. I don't think you understand the concept of an "operating system."
Aug 19 '13 at 20:41 comment added xuinkrbin. @Kevin: how would Apple do that, if it did?
Aug 19 '13 at 20:38 comment added tubedogg I was going to say something along the same lines. If you don't trust the third-party to whom you are sending app bundle, it is perhaps time to reevaluate how you are intending to distribute your app.
Aug 19 '13 at 20:37 comment added Kevin If you don't trust Apple, this exercise is pointless. They are running your program, if they want to get any information out of it, they can do it quite easily without touching your binary.
Aug 19 '13 at 20:34 comment added xuinkrbin. @tubedogg: I also need to make sure that "Someone" to Whom I refer is not Apple, either.
Aug 19 '13 at 20:33 comment added xuinkrbin. @Kevin: I am writing an app where security is needed at all stages. Given questions about iOS/iCloud security and sharing information with third parties, I need to ensure, for example, Someone has not placed a key logging library inside the app after I sign it.
Aug 19 '13 at 20:31 comment added tubedogg To be clear...your thinking is that Apple's servers will be hacked to substitute your app bundle with some sort of malware? I don't believe there have been any cases of this occurring since the App Store started several years ago, so I think you are probably quite safe on that front.
Aug 19 '13 at 20:25 comment added Kevin Your app and all the resources are already signed and iOS won't let it run without verifying the signatures, why do you think you really need more than that?
Aug 19 '13 at 20:16 history asked xuinkrbin. CC BY-SA 3.0