4 ms·
The author doesn't explain why this is a google problem other than their code is "old". The way the source article reads, it seems like the vulnerability would
by kjaftaedi 7y ago
The author doesn't explain why this is a google problem other than their code is "old".
The way the source article reads, it seems like the vulnerability would affect any OTP app.
- edent 7y agoThe latest version of [andOTP](https://github.com/andOTP/andOTP/releases https://github.com/andOTP/andOTP/releases) indicates that it protects some of the fields from accessibility hijack. I suspect other apps will find a way to prevent this attack. The problem I, the author, have is that it seems unlikely that Google can fix this. What are the risks associated with suddenly changing a codebase which is 2.5 years old? Is there anyone there who works on it day-to-day, understands how it works, and can release a verifiably fixed patch? Security products need constant maintainance.
- smt88 7y agoNo user should trust the security of an app that was abandoned 2.5 years ago. It's irresponsible (and typical) of Google to keep the app available and unmaintained. Even if the code were bug-free at the time, dependencies, APIs, and attacks change.