4 ms·

What's going on here? The article doesn't call this issue a "security bug" anywhere in the article. This and ZDNet's article don't claim this is a vulnerabili

by DCKing 7y ago

What's going on here? The article doesn't call this issue a "security bug" anywhere in the article. This and ZDNet's article don't claim this is a vulnerability or bug, but are reporting on the relative novelty of malware targeting 2FA apps. The article doesn't even claim Google Authenticator or third party apps should mitigate it, or that third party apps are any better at it. The first three paragraphs and the last one of this comment are just railing against some strawman. There are 0 claims about vulnerabilities or security weaknesses in this article. Finally, I frankly find your claim about open source apps being bad ridiculous. What's the alternative, never trust indie developers, only trust the big corporations? Also: the blanket "Allow unknown sources" has not been a thing since Android 8.0 - you have to select individual trusted sources (e.g. F-Droid, which actually has a superficial volunteer review process). You can't buy a new Android device which forces you to use blanket unknown sources anymore unless you really try. I like contrarian arguments on HN as much as the next guy, but I only like those that actually respond to what the article says. At worst, the article's use of the ZDNet is too opportunistic to drive its other valid points.

Someone1234 7y ago
> Finally, I frankly find your claim about open source apps being bad ridiculous. Nobody called Open Source bad. What got posted was: > As soon as it is from the app store the "open source" nature is completely irrelevant, it isn't a security guarantee. Unclear how you got from "no security guarantee [with compiled open source in the app store]" to "open source is bad." Those two things aren't even similar. The biggest problem with Open Source in the app store is actually automatic updates. It is conceivable to build the app locally and compare the resulting APK to the app store version. But it isn't very realistic to do that every update (or even just follow the repo changes long term). Most of the time these types of issues aren't important because apps are well sandbox on Android. But in the case of password and two factor managers special consideration has to be taken because the data within the app's sandbox is highly valued, and extrication is trivial with all apps having the default android.permission.INTERNET privilege.
- DCKing 7y ago
  Is railing against uncharitable interpretations of other people your thing today? I'm sorry for summarizing that paragraph so shortly, I don't actually think you think open source is bad.
calebegg 7y ago
> This and ZDNet's article don't claim this is a vulnerability or bug > The article doesn't even claim Google Authenticator or third party apps should mitigate it Second sentence of the article is "I doubt Google will ever release a fix for this issue". We could argue about the semantics of "issue" vs "bug" (though I'd rather not), but it seems pretty obvious the author thinks of this as a fixable "issue", when the parent comment's point is that it absolutely isn't.

by DCKing 7y ago

Someone1234 7y ago

> Finally, I frankly find your claim about open source apps being bad ridiculous. Nobody called Open Source bad. What got posted was: > As soon as it is from the app store the "open source" nature is completely irrelevant, it isn't a security guarantee. Unclear how you got from "no security guarantee [with compiled open source in the app store]" to "open source is bad." Those two things aren't even similar. The biggest problem with Open Source in the app store is actually automatic updates. It is conceivable to build the app locally and compare the resulting APK to the app store version. But it isn't very realistic to do that every update (or even just follow the repo changes long term). Most of the time these types of issues aren't important because apps are well sandbox on Android. But in the case of password and two factor managers special consideration has to be taken because the data within the app's sandbox is highly valued, and extrication is trivial with all apps having the default android.permission.INTERNET privilege.

DCKing 7y ago
Is railing against uncharitable interpretations of other people your thing today? I'm sorry for summarizing that paragraph so shortly, I don't actually think you think open source is bad.

calebegg 7y ago

> This and ZDNet's article don't claim this is a vulnerability or bug > The article doesn't even claim Google Authenticator or third party apps should mitigate it Second sentence of the article is "I doubt Google will ever release a fix for this issue". We could argue about the semantics of "issue" vs "bug" (though I'd rather not), but it seems pretty obvious the author thinks of this as a fixable "issue", when the parent comment's point is that it absolutely isn't.