3 ms·

> I think you massively overestimate how many people would use that functionality. I admit that I know very little about Fortnite and am not a regular Android

> I think you massively overestimate how many people would use that functionality. I admit that I know very little about Fortnite and am not a regular Android user, but my understanding is that, right now, anyone who wants to play Fortnite on Android is sideloading it. That's a lot of people who are opening up a pretty brutal attack vector to be able to play a game that got kicked out of the official Play Store. https://www.theverge.com/2020/8/13/21368079/fortnite-epic-android-banned-google-play-app-store-rule-violation https://www.theverge.com/2020/8/13/21368079/fortnite-epic-an...

Wowfunhappy 6y ago
It didn't get kicked out of the store for violating people's privacy or some such, it got kicked out because they didn't want to pay Google money in exchange for absolutely nothing. Sideloading Fortnite is not opening up an attack vector unless Fortnite itself is malicious, which it's not, because it's a huge game from a huge company. As long as the official download source is known to everybody, I think it's fine. I know there are fake (malicious) copies of Fortnite out there, but those promise free V-Bucks or some such. You could just as easily run that scam without sideloading and target the user's credit card number of similar.
- nodamage 6y ago
  I think you're understimating the level of risk associated with people attempting to sideload Fortnite. People aren't necessarily intentionally seeking shady versions (but even if they were, I find this kind of victim-blaming counterproductive). They were doing things like searching "how to install Fortnite" on Google or Youtube and getting sent links to fake versions with malware loaded. [1] How were non-sophisticated users supposed to figure out that the Epic link was the correct link to click among the thousands of search results? How many of the people wanting to play Fortnite for the first time even knew what Epic was? > As long as the official download source is known to everybody It's not, and that's the problem. [1] https://blog.malwarebytes.com/cybercrime/2018/06/fake-fortnite-android-links-found-youtube/ https://blog.malwarebytes.com/cybercrime/2018/06/fake-fortni...
  - Wowfunhappy 6y ago
    I guess my question is, is this problem really unique to sideloading, and if not, can it be addressed in the same ways we address other problems? For example, does everyone know the official source of Facebook? If so, why, and if not, why is there not an epidemic of fake Facebook scams that steal login credentials? I know there are targeted phishing attacks, which is a separate issue, but I haven't heard of significant attacks from people who just didn't know the correct login page. One way we do deal with this is with targeted blacklists of known-bad sites, particularly Google Safe-browsing. That's certainly a mechanism that could be employed for Android Malware—and I think it already is, actually. Problems do happen—but I don't see anyone calling on Google to restrict Chrome to a whitelisted set of approved URLs. And I'd posit that gaining access to someone's Facebook account is no less invasive than gaining access to their phone.
    - nodamage 6y ago
      Don't the overwhelming majority of people access Facebook via the app these days? So the official source of Facebook for those people is... the App Store or the Google Play Store. > And I'd posit that gaining access to someone's Facebook account is no less invasive than gaining access to their phone. I don't think so. Accessing someone's Facebook messages and photos is one thing, gaining access to their phone means gaining access to their email which means potential access to any account linked to that email. Given how many people use mobile banking these days, I'd say there's a lot more potential for damage if your phone is compromised.

Wowfunhappy 6y ago

It didn't get kicked out of the store for violating people's privacy or some such, it got kicked out because they didn't want to pay Google money in exchange for absolutely nothing. Sideloading Fortnite is not opening up an attack vector unless Fortnite itself is malicious, which it's not, because it's a huge game from a huge company. As long as the official download source is known to everybody, I think it's fine. I know there are fake (malicious) copies of Fortnite out there, but those promise free V-Bucks or some such. You could just as easily run that scam without sideloading and target the user's credit card number of similar.

nodamage 6y ago
I think you're understimating the level of risk associated with people attempting to sideload Fortnite. People aren't necessarily intentionally seeking shady versions (but even if they were, I find this kind of victim-blaming counterproductive). They were doing things like searching "how to install Fortnite" on Google or Youtube and getting sent links to fake versions with malware loaded. [1] How were non-sophisticated users supposed to figure out that the Epic link was the correct link to click among the thousands of search results? How many of the people wanting to play Fortnite for the first time even knew what Epic was? > As long as the official download source is known to everybody It's not, and that's the problem. [1] https://blog.malwarebytes.com/cybercrime/2018/06/fake-fortnite-android-links-found-youtube/ https://blog.malwarebytes.com/cybercrime/2018/06/fake-fortni...
- Wowfunhappy 6y ago
  I guess my question is, is this problem really unique to sideloading, and if not, can it be addressed in the same ways we address other problems? For example, does everyone know the official source of Facebook? If so, why, and if not, why is there not an epidemic of fake Facebook scams that steal login credentials? I know there are targeted phishing attacks, which is a separate issue, but I haven't heard of significant attacks from people who just didn't know the correct login page. One way we do deal with this is with targeted blacklists of known-bad sites, particularly Google Safe-browsing. That's certainly a mechanism that could be employed for Android Malware—and I think it already is, actually. Problems do happen—but I don't see anyone calling on Google to restrict Chrome to a whitelisted set of approved URLs. And I'd posit that gaining access to someone's Facebook account is no less invasive than gaining access to their phone.
  - nodamage 6y ago
    Don't the overwhelming majority of people access Facebook via the app these days? So the official source of Facebook for those people is... the App Store or the Google Play Store. > And I'd posit that gaining access to someone's Facebook account is no less invasive than gaining access to their phone. I don't think so. Accessing someone's Facebook messages and photos is one thing, gaining access to their phone means gaining access to their email which means potential access to any account linked to that email. Given how many people use mobile banking these days, I'd say there's a lot more potential for damage if your phone is compromised.