cross-posted from: https://fost.hu/post/226135
Let’s say, I create a bank with the caveat that all of my banking phone apps and webapps are FOSS (or if they depend on non-free components — banks probably do to communicate with each other —, then just OSS). Am I going to be behind the competition by doing this?
If the most secure crypto algorithms are the ones that are public, can we ensure the security of a bank’s apps by publicizing it?
Are they not doing this because they secretly collect a lot of data (on top of your payment history because of the centralized nature of card payments) through these apps?
EDIT: Clarifying question: Is there a technical reason they don’t publicize their code or is it just purely corporate greed and nothing else?
Keep in mind that while FOSS is doing well against MITM attacks it often falls short against MATE attackers. Whitebox crypto, obfuscation, integrity checks etc. are widely used to keep malware and malicious users from fucking with your binaries, extracting keys etc. They really don’t want to leave it to their users to keep their candy crush clone riddled shitboxes secure