Technology in Hostile States: Ten Principles for User Protection
11. Validate your controls through extensive code review and testing.  Don't expect that just because something is open source that this has happened.  Don't just take security "best practices" as the truth.<p>To principle 11, this year we were once again reminded why regurgitating security advice without looking into the actual implementation can be a problem.  For years security and privacy advocates told users to use proxies in combination with HTTPS to protect their privacy and security, yet it turns out that this advice as applied to iOS and macOS allowed full middling of HTTPS connections by any bad actor with access to the users network.  For all other operating systems, as covered in the CERT advisory, it lead to the ability to phish for authentication credentials:<p><a href="http://www.falseconnect.com/" rel="nofollow">http://www.falseconnect.com/</a>