9 ms·

Why is this not considered a bug in Android? Hasn't this just shown how any app can add a feature to download other apps? Why wouldn't Facebook add that feature

Why is this not considered a bug in Android? Hasn't this just shown how any app can add a feature to download other apps? Why wouldn't Facebook add that feature to the Facebook app so they can forcefully install any other app they want?

javagram 8y ago
Facebook wouldn’t do that because they don’t need to use illegal/shady means to install their apps, users happily download and install them. This isn’t a bug “in android” since it can only happen when the user enables permissions to install third party app stores - the Fortnite installer is essentially an App Store that could be tricked to installing any APK rather than the one it means to.
- stale2002 8y ago
  It is absolutely a bug in Android. The "bug" is that it is extremely difficult for users to install 3rd party apps securely. If it was easier for developers to securely offer 3rd party downloads, then stuff like this wouldn't happen.
  - tehlike 8y ago
    Suggest a way.
    - tokyodude 8y ago
      A browser does this with every page you visit so there's clearly a path between what we have and what could be.
    - ForHackernews 8y ago
      In apt, you can specify trusted keys for repositories and the packages downloaded are verified. Most Debian-based systems ship with standard repositories, but it's easy to add others.
      - tehlike 8y ago
        Suggest a usable way. Friendly to people.
        tehlike 8y ago
        I hope downvoters see the reason why security is a compromise for user friendliness.
        detaro 8y ago
        Instead of asking "Allow Epic Installer to install apps", have the option to ask "Allow Epic Installer to install apps by the same publisher", and have to OS do the signature check. This would cover the vast majority of app stores, especially if multiple signatures are allowed.
        tehlike 8y ago
        This is fair, but more app stores also mean more points of failure. We learned quite a bit from what happens in cases like this from root ca's. We had to have certificate transparency, browsers distrusting ca's from vulnerable ca's and so on. So i would argue this is not as simple as that. I dont necessarily trust fortnite keeping their keys secure, for example.
        deleted 8y ago
        [deleted]
        gsich 8y ago
        Imagine something as your parent with a gui.
        sparkie 8y ago
        If a user already has F-droid installed, they can scan a QR code, verify that the signature matches, or just click on URL. Example here: https://f-droid.monerujo.io/ https://f-droid.monerujo.io/ The only difficult part is the user getting f-droid on their device to begin with. If google play implemented the functionality provided by F-droid, they wouldn't need to. Manufacturers should just put F-droid on new devices as standard.
  - quantummkv 8y ago
    That is the problem. There is no way to securely allow 3rd party downloads. Microsoft learnt that the hard way.
    - AnthonyMouse 8y ago
      > That is the problem. There is no way to securely allow 3rd party downloads. Microsoft learnt that the hard way. There is a huge difference between no one has vetted this program and someone other than the device manufacturer has vetted this program. In a contest of "trustworthy not to contain malware" the Debian package manager beats Google Play, and you don't need approval from Dell or Microsoft to use it.
Shywim 8y ago
It already exists on newish (since 2017) phones and it's called "Facebook App Manager".
deleted 8y ago
[deleted]
beenBoutIT 8y ago
Google Play's TOS generally prohibit apps that install APK. This is why apps like F-droid, Amazon(full-featured variant), getChromium, Amaze, etc. aren't available on Google Play.

javagram 8y ago

Facebook wouldn’t do that because they don’t need to use illegal/shady means to install their apps, users happily download and install them. This isn’t a bug “in android” since it can only happen when the user enables permissions to install third party app stores - the Fortnite installer is essentially an App Store that could be tricked to installing any APK rather than the one it means to.

stale2002 8y ago
It is absolutely a bug in Android. The "bug" is that it is extremely difficult for users to install 3rd party apps securely. If it was easier for developers to securely offer 3rd party downloads, then stuff like this wouldn't happen.
- tehlike 8y ago
  Suggest a way.
  - tokyodude 8y ago
    A browser does this with every page you visit so there's clearly a path between what we have and what could be.
  - ForHackernews 8y ago
    In apt, you can specify trusted keys for repositories and the packages downloaded are verified. Most Debian-based systems ship with standard repositories, but it's easy to add others.
    - tehlike 8y ago
      Suggest a usable way. Friendly to people.
      - tehlike 8y ago
        I hope downvoters see the reason why security is a compromise for user friendliness.
      - detaro 8y ago
        Instead of asking "Allow Epic Installer to install apps", have the option to ask "Allow Epic Installer to install apps by the same publisher", and have to OS do the signature check. This would cover the vast majority of app stores, especially if multiple signatures are allowed.
        tehlike 8y ago
        This is fair, but more app stores also mean more points of failure. We learned quite a bit from what happens in cases like this from root ca's. We had to have certificate transparency, browsers distrusting ca's from vulnerable ca's and so on. So i would argue this is not as simple as that. I dont necessarily trust fortnite keeping their keys secure, for example.
        deleted 8y ago
        [deleted]
      - gsich 8y ago
        Imagine something as your parent with a gui.
      - sparkie 8y ago
        If a user already has F-droid installed, they can scan a QR code, verify that the signature matches, or just click on URL. Example here: https://f-droid.monerujo.io/ https://f-droid.monerujo.io/ The only difficult part is the user getting f-droid on their device to begin with. If google play implemented the functionality provided by F-droid, they wouldn't need to. Manufacturers should just put F-droid on new devices as standard.
- quantummkv 8y ago
  That is the problem. There is no way to securely allow 3rd party downloads. Microsoft learnt that the hard way.
  - AnthonyMouse 8y ago
    > That is the problem. There is no way to securely allow 3rd party downloads. Microsoft learnt that the hard way. There is a huge difference between no one has vetted this program and someone other than the device manufacturer has vetted this program. In a contest of "trustworthy not to contain malware" the Debian package manager beats Google Play, and you don't need approval from Dell or Microsoft to use it.

Shywim 8y ago

It already exists on newish (since 2017) phones and it's called "Facebook App Manager".

deleted 8y ago

[deleted]

beenBoutIT 8y ago

Google Play's TOS generally prohibit apps that install APK. This is why apps like F-droid, Amazon(full-featured variant), getChromium, Amaze, etc. aren't available on Google Play.