5 ms·

Dammit. Stuff like this is exactly what is going to destroy the app market for the Android. Who's going to download anything if they hear this can even happen

by dpcan 17y ago

Dammit. Stuff like this is exactly what is going to destroy the app market for the Android. Who's going to download anything if they hear this can even happen? Most developers complain about the Apple iPhone approval process, but they don't realize how much it really HELPS them. Consumer confidence keeps people buying mobile apps, and with the iPhone, nobody even thinks twice about it because we have the added comfort of knowing Apple stomps out the bad stuff - usually before we ever see it.

algorias 17y ago
How is that different from desktop apps, from web apps, from an OS even? Any program you trust in whatever way can do bad, bad things with your banking details, private data, list of contacts, etc.
- potatolicious 17y ago
  That isn't what happened here. Someone submitted an app purporting to be from the bank. I'm presuming that Apple will at least perform the diligence of making sure the app author is who they say they are.
  - patio11 17y ago
    Someone submitted an app purporting to be from the bank. Someone bought bank-of-america.ru too. I don't see how that is materially different.
  - JunkDNA 17y ago
    Having just gone through this with Apple for a major name organization, I can assure you they take the identity of developers very seriously. You have to be who you say you are.
- jmtulloss 17y ago
  It's different because of the source. People trust the bank's website because they see the URL and know that it's genuine. People trust brick and mortar stores because they trust Best Buy to deliver products from the people they say they're from. People trust the app store on their phone just like a brick and mortar store... that is, they expect that somebody is ensuring the validity of the products that are being shown to them. There is no other way for the consumer to validate this information, so the store provider must.
thwarted 17y ago
Exactly how much of the actual code is examined as part of Apple's app approval? What's to keep someone from creating a time-bomb app, that is benign until a certain date or signal is received? A game app that keeps a centralized high-score list on a server somewhere could use that as a back-channel to send flags to enable some kind of malicious mode. In that case, Apple could remove stuff after the fact, but everyone who had already downloaded it would be affected. The only advantage is that Apple keeps developer documentation about who submitted which app, so the guilty parties are potentially traceable, but there's a chance even that could be social-engineered. The openness of the Android platform actually allows the marketplace to meet the demand for verified apps, the same way SSL certs are supposed to be (but the market for SSL cert signing is geared toward the server end, not the consumer end, and they keep screwing up the high verification certs by making people jump through stupid hoops when they want them).
- xsmasher 17y ago
  Since iPhone apps are sandboxed your time bomb app is unlikely. Apps can access their own data and that's it. The iPhone app store also lists the creator of the app - either the person's name or or their company name. If you use a company name you must provide legal docs; that probably would have prevented this situation. Does the Android app store not have checks like that?
city41 17y ago
Except Apple's approval process really wouldn't have prevented this. Most iPhone apps phone home without almost any user being the wiser. Who knows what most iPhone IM apps or apps like 1Password (basically any app that allows the user to put in any type of freeform information) are doing behind the scenes.
- Retric 17y ago
  They would not have approved an app that was pretending to be written by a different company.
  - city41 17y ago
    No, but let's pretend a master password app silently sends the password info back home periodically. Apple's process would let an app like that through. It'd be pretty stupid for a developer to do this (I even think it's stupid for an Android dev to do this), as they'd certainly get caught. But Apple's submission process wouldn't be what caught them.

by dpcan 17y ago

algorias 17y ago

How is that different from desktop apps, from web apps, from an OS even? Any program you trust in whatever way can do bad, bad things with your banking details, private data, list of contacts, etc.

potatolicious 17y ago
That isn't what happened here. Someone submitted an app purporting to be from the bank. I'm presuming that Apple will at least perform the diligence of making sure the app author is who they say they are.
- patio11 17y ago
  Someone submitted an app purporting to be from the bank. Someone bought bank-of-america.ru too. I don't see how that is materially different.
- JunkDNA 17y ago
  Having just gone through this with Apple for a major name organization, I can assure you they take the identity of developers very seriously. You have to be who you say you are.
jmtulloss 17y ago
It's different because of the source. People trust the bank's website because they see the URL and know that it's genuine. People trust brick and mortar stores because they trust Best Buy to deliver products from the people they say they're from. People trust the app store on their phone just like a brick and mortar store... that is, they expect that somebody is ensuring the validity of the products that are being shown to them. There is no other way for the consumer to validate this information, so the store provider must.

thwarted 17y ago

Exactly how much of the actual code is examined as part of Apple's app approval? What's to keep someone from creating a time-bomb app, that is benign until a certain date or signal is received? A game app that keeps a centralized high-score list on a server somewhere could use that as a back-channel to send flags to enable some kind of malicious mode. In that case, Apple could remove stuff after the fact, but everyone who had already downloaded it would be affected. The only advantage is that Apple keeps developer documentation about who submitted which app, so the guilty parties are potentially traceable, but there's a chance even that could be social-engineered. The openness of the Android platform actually allows the marketplace to meet the demand for verified apps, the same way SSL certs are supposed to be (but the market for SSL cert signing is geared toward the server end, not the consumer end, and they keep screwing up the high verification certs by making people jump through stupid hoops when they want them).

xsmasher 17y ago
Since iPhone apps are sandboxed your time bomb app is unlikely. Apps can access their own data and that's it. The iPhone app store also lists the creator of the app - either the person's name or or their company name. If you use a company name you must provide legal docs; that probably would have prevented this situation. Does the Android app store not have checks like that?

city41 17y ago

Except Apple's approval process really wouldn't have prevented this. Most iPhone apps phone home without almost any user being the wiser. Who knows what most iPhone IM apps or apps like 1Password (basically any app that allows the user to put in any type of freeform information) are doing behind the scenes.

Retric 17y ago
They would not have approved an app that was pretending to be written by a different company.
- city41 17y ago
  No, but let's pretend a master password app silently sends the password info back home periodically. Apple's process would let an app like that through. It'd be pretty stupid for a developer to do this (I even think it's stupid for an Android dev to do this), as they'd certainly get caught. But Apple's submission process wouldn't be what caught them.