Ok so I was thinking about this as well while I was at one of those modern mobile banks.
With closed source apps — as soon as you write for the JVM or in JS (i.e. Android and Web), you’re exposing the inner workings of your app… more or less.
With C/C++ and similar stacks (read: Desktop or iOS or native parts of Android), one could argue that you expose less. But still, all code on clients is exposed, theoretically, so either way I don’t believe that open code itself would be much more problematic than what code is today in closed source apps. We did a bunch of things that are considered safety measures, and those could be coded into an OSS app as well.
But then, there is network encryption, potential implementations of cert pinning, integrations with other services/tools, secret keys, local storage, databases, and many other things that might be hard to lock down completely or even audit for security risks… this was the really tough part I believed. But maybe it’s just my knowledge gap, that’s fair as well.
In the end, my thinking was “omg I’d miss something for sure, and it would be easy for hackers to kill the project and steal everything”… and therefore OSS is not the way to go. I’m more confident nowadays. But then again, cryptocurrencies are open for the most part… so that’s an interesting counter-argument I guess. (:
I wonder what others think. I also wonder if there are open tools or checklists for security audits…