While I agree reproducible builds are a huge part of the answer, if you get your builds from Google Play or the App Store you have no idea if anyone has reproduced the particular build that was served to your device.
A solution to this would be independent reproducible builds like F-Droid does, but Moxie rejected this citing it would cause them to lose control of the platform and install metrics Google and Apple provide. Always thought that was a weird position for a privacy tool.
Any community that cares could then at least make the right choice of client for their community. The masses never care, but what matters is that privacy is actually a choice.
At the risk of being pedantic, that's not exactly what the principle says. It's claim is that a cryptosystem should be secure even if everything about the system except the private key is public knowledge. It doesn't require that the system be public, only that the security of a non-public system shouldn't rely on it's non-public nature. A closed source cryptosystem designed to still be secure even if someone discovers how it works satisfies the principle just fine.
It's an even simpler user experience to just publicly publish all private information.
Can you imaging, I wouldn't even need to give my social security number to another org manually again. Anyone could just look it up. It would make things so easy for everyone.
It's a trade off. If someone wanted they could keep reducing security to improve the user experience, but a product having bad security will be problematic.
>Anyone could just look it up.
Most people's SSNs have already been leaked or stolen so it's just security theater to pretend they are still private information.
