A while back I asked HN if there was any way I could trust an iOS keepass client. The answer was no, on the basis that you have no way of auditing whether the open source code built what’s in the App Store. Nor is there a way of preventing a rogue keepass client app from accessing the internet and exfiltrating your database and password.
So how do you do this in practice? Do you just send some guy (that you trust!) hashes of all the files on your system and hope that he spots the backdoored binary soon enough?
Perhaps there's some false assumption there that the "app store" will serve everyone a backdoored binary, instead of performing almost undetectable targeted attacks.
Ostensibly because then you'd have to deploy it yourself to the iOS device - which is fine for your iPhone but not so easy for your parents' iPads across the country/world.
Has any of that changed recently?