Client-side filtering of private data is a bad idea

1) that it is effectively impossible to reverse engineer binary code and understand it (particularly so if it is obfuscated in any way at all, as the security claims made by the people who develop such tools are often absurd).

2) that it is additionally possible to prevent the hacker from getting access to even their binary, as it is encrypted by the app store and might require jailbreaking the device; either way, it is akin to piracy and thereby illegal.

3) that it is possible to add further mitigations to prevent people from analyzing your app, such as certificate pinning for all of your network requests, or trying to verify the device is "authentic" and not running a jailbroken OS.

Now, "obviously", all these beliefs are all false; but the problem is that, in some sense, they also are not entirely wrong, and so they stick: I am extremely competent at reverse engineering, but I am going to groan given the task of reverse engineering an iPhone app if I find myself forced by certificate pinning to work around some obfuscated network checks after stealing a copy of the app using a jailbroken phone... like, these mitigations actually do make it a lot more annoying for me to do any of this work, and I certainly am not going to that much effort in a casual drive-by fashion.

Meanwhile, client-side security is also a thing the industry relies on in other ways: developers want to limit denial of service attacks or limit piracy of their product or limit external access to private user data stored on the device, and these techniques that "don't work" can certainly raise the bar for an attacker, and so aren't considered dumb in the general case.

I think the real core education is that people don't understand how to determine what kind of credential should be required to access what kind of information, and that different pieces of interoperating software might all possess different credentials, and the limits on those credentials need to be honored.

This also comes up with things like with tokens for various services: people will sign up for a service, and then store the with token in the app so they can make API calls from the client... but now, I have their auth token, right? They don't get that, and part of the reason is that a lot of services kind of encourage that model. And like, with your OpenAI key, at least the damage is probably "just" monetary; but, if it is your AWS key, suddenly it is super serious.

So, yeah: I think developers will, in fact, say stuff like client-side filtering "isn't that bad", or that "it might be justifiable under some circumstances"; and they might even be sort of almost right at times for certain kinds of checks (not with other user's data, of course ;P) under certain kinds of tradeoffs... but then misapply the boundary in a way that is flat-out incorrect.

Now, is this article the article that would explain this or convince the developer that these cases are wrong? I don't know... it isn't even clear to me that that's their audience, as opposed to being more of a portfolio piece that the author does understand this issue and thereby is competent at one or both of security engineering or website development (and, FWIW, I think it is sufficiently successful at that).

If you're running a Linux, you're probably much more protected, but even then, on Ubuntu and most other popular distros, you probably download all or most of your apps with apt or rpm from their own official repos, so they probably can get a pretty good idea of what you're running.

The situation is generally better than on mobile, but unless you're taking significant pains, you're still a pretty open book to your OS manufacturer. Whether they're reading this book or not is a separate matter.

You're speaking from an absurdly low level of trust in instituions. The fact is that banks work, they shield their clients from mass amounts of fraud, and do so reliably over decades. The vast majority of people have never lost a single cent to a bank mistake. Google employees don't have routine access to your emails, and if some group do and use that power and Google gets sued, it will very likely be found out at trial, because most ordinary employees don't perjure themselves to protect colleagues for obvious ilegalities (outside the police, but that's a different discussion). Of course, the chance of actually successfully pursuing a suit against Google is small for a mere mortal, but that's a different issue that has to do with corruption in the system and not a fundamental inability to achieve this.