4 ms·
Kudos to Epic for using their power to attempt to break Google's Play Store hegemony, facepalms for unfortunately proving one of Google's (both legit and preten
by klingonopera 7y ago
Kudos to Epic for using their power to attempt to break Google's Play Store hegemony, facepalms for unfortunately proving one of Google's (both legit and pretended) concerns on safety and security regarding acquiring apps from outside of the Play Store.
- scarface74 7y agoHasn’t the entire argument been that Android’s permission system would have prevented this even if the app was installed outside of the store?
- lern_too_spel 7y agoThe Epic app installed other apps using a private Samsung API, so the apps were installed using the permissions of the Samsung Galaxy Apps Store app, which has permission to install other apps (on Samsung devices). There is nothing to stop a similar confused deputy vulnerability in the iOS App Store. The Android permission system prevents it from taking pictures or doing other things it was not granted permission to do.
- scarface74 7y agoExcept there isn’t a way for an app to download code outside of the App Store and have the executable bit set.....
- lern_too_spel 7y agoThere isn't a way to do that on Android either. You have to use the confused deputy to install the app.
- scarface74 7y agoThe installer as designed was able to download code and execute it - so there was obviously a way to do it on Android.
- lern_too_spel 7y ago> The installer as designed was able to download code and execute it No, it was able to download code and ask a Samsung app store system app to install it. This doesn't work on non-Samsung Android devices, and the exact same confused deputy problem can exist on iOS.