5 ms·

It’s not really that difficult. Just create a clone app, pass the initial store review, then change the icon/description to be close to the official app in an u

by 05 9y ago

It’s not really that difficult. Just create a clone app, pass the initial store review, then change the icon/description to be close to the official app in an update, and opt out of AppStore search, so that it can only be accessed through a link. It’s just that the payoff is much less impressive than on Android.. although, I guess, you can always try to sneak in a VPN entitlement, and hope the reviewer is extra incompetent that day..

tptacek 9y ago
That assumes that Apple hasn't automated the process of hunting those particular targeted applications out, which is not a safe assumption anymore. To be fair: I'm pretty certain Google also automates detection of this stuff. The problem with Android is sideloading. Apple was right about this.
- loup-vaillant 9y ago
  > Apple was right about this. I hate it when Apple is right. And I hate that their golden numerical prison has genuine advantages over the alternatives. Assuming users cannot be fixed, what can? Users sideload apps from the web, right? Can't there be an easy way to distinguish trustworthy communications from potentially dangerous ones? Would such a way be systematically worked around by ever cleverer phishers?
  - mulmen 9y ago
    With great power comes great responsibility. There is no way to give users more power without also giving them more responsibility.
- cageface 9y ago
  Making side loading opt-in and warning users of the security risks seems like a better compromise to me than requiring that every app on my phone is vetted by a single gatekeeper. "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." and all that.
  - geocar 9y ago
    > requiring that every app on my phone is vetted by a single gatekeeper. What are you referring to here? I just installed an SNES emulator on my iPhone without jailbreaking and without paying Apple for a developer account. I don't think Apple knows anything about the app.
    - willstrafach 9y ago
      Apple is well aware of the rogue Enterprise certificates used for those. They also probably do not care much about those which you can sign with your Apple ID, as it is bound to your specific device UDID.
      - geocar 9y ago
        I didn't use a "rogue Enterprise certificate".
        willstrafach 9y ago
        Both methods work.
- willstrafach 9y ago
  > That assumes that Apple hasn't automated the process of hunting those particular targeted applications out, which is not a safe assumption anymore. I am quite certain they do. When clone apps pop up in the App Store, they are removed very quickly.
dcow 9y ago
The EFF report specifically said they don't ask for more permissions. They just chose apps with good permissions already. Most of the scary stuff in the report is from actual Windows desktop trojans. The mobile stuff is just plain repack.

by 05 9y ago

tptacek 9y ago

That assumes that Apple hasn't automated the process of hunting those particular targeted applications out, which is not a safe assumption anymore. To be fair: I'm pretty certain Google also automates detection of this stuff. The problem with Android is sideloading. Apple was right about this.

loup-vaillant 9y ago
> Apple was right about this. I hate it when Apple is right. And I hate that their golden numerical prison has genuine advantages over the alternatives. Assuming users cannot be fixed, what can? Users sideload apps from the web, right? Can't there be an easy way to distinguish trustworthy communications from potentially dangerous ones? Would such a way be systematically worked around by ever cleverer phishers?
- mulmen 9y ago
  With great power comes great responsibility. There is no way to give users more power without also giving them more responsibility.
cageface 9y ago
Making side loading opt-in and warning users of the security risks seems like a better compromise to me than requiring that every app on my phone is vetted by a single gatekeeper. "Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety." and all that.
- geocar 9y ago
  > requiring that every app on my phone is vetted by a single gatekeeper. What are you referring to here? I just installed an SNES emulator on my iPhone without jailbreaking and without paying Apple for a developer account. I don't think Apple knows anything about the app.
  - willstrafach 9y ago
    Apple is well aware of the rogue Enterprise certificates used for those. They also probably do not care much about those which you can sign with your Apple ID, as it is bound to your specific device UDID.
    - geocar 9y ago
      I didn't use a "rogue Enterprise certificate".
      - willstrafach 9y ago
        Both methods work.
willstrafach 9y ago
> That assumes that Apple hasn't automated the process of hunting those particular targeted applications out, which is not a safe assumption anymore. I am quite certain they do. When clone apps pop up in the App Store, they are removed very quickly.

dcow 9y ago

The EFF report specifically said they don't ask for more permissions. They just chose apps with good permissions already. Most of the scary stuff in the report is from actual Windows desktop trojans. The mobile stuff is just plain repack.