9 ms·

>Sure, the developer name "Develop App" sounds strange and should I have looked better, the developgameonline@gmail.com developer email and com.acazira.tforbusi

>Sure, the developer name "Develop App" sounds strange and should I have looked better, the developgameonline@gmail.com developer email and com.acazira.tforbusiness package name would have definitely raised some concerns. Come on, dude. I will say that even the most experienced techies among us sometimes become complacent and let our guard down. It's exhausting having to constantly second-guess every application you want to run. (Not interested in starting another platform flame war, but this is the main reason I don't use Android. I deal with enough paranoia running Windows daily. Maybe I'm misinformed, but I'm also probably not unique in this respect) I'm curious if this fake TikTok app would probably have been blocked at the outset in the Apple App Store review process because it's trying to masquerade as another business ?

actionowl 6y ago
Not being an android user and not being familiar with the Play story I might have glanced over "Develop App" having internally misread it as "Developer App" and thinking it was a category, not the developer's name.
- NiekvdMaas 6y ago
  Exactly this, it doesn't really stand out. Obviously I wouldn't have installed the app if I would have noticed.
  - muststopmyths 6y ago
    I wasn't trying to excoriate you for your mistake, so I apologize if that's how it comes across. I did try to modulate the harshness of "Come on, dude" with the rest of my comment. Like I said, sometimes we let our guard down. So it's understandable if you got fooled. In hindsight there are more red flags in just that screenshot ("More by Develop App", obviously fake reviews to point out just two), but God knows I've clicked through installs for shit apps on iOS many times.
    - ShroudedNight 6y ago
      FWIW, Given the surrounding context, I interpreted "Come on, dude" as an exhortation for the author to cut themselves some slack. I agree that 100% correct 100% of the time is an exhausting bar to maintain, and one that we should be working very hard to ease this requirement. I think it's worth pointing out that the difficulty / impossibility of achieving that bar (at least in the general case) is one of, if not the central tenet of Christianity, ostensibly the dominant religion of the West for something like 1500 years. Regardless of one's metaphysical beliefs, it's worth remembering that arguments for the necessity of grace and slack in positive interactions have a long historical precedent, and I find we ignore them at our peril.
    - NiekvdMaas 6y ago
      No worries, no offense taken. I still can't believe myself I fell for this, as said I have 2FA on all accounts and I'm normally very cautious. I guess it's a combination of all the factors here at play: Facebook allowing a fake TikTok Ads advertiser, the ad looking very legit (referring to an existing ad credit program), Google allowing a fake TikTok Ads app with fake reviews, and not getting any notifications until the amount was charged from my PayPal account.
  - donmcronald 6y ago
    I didn't notice it the first time I looked either :-( Bad spelling and grammar used to be a great indicator of something being amiss, but the volume of it in legit business these days has made me so desensitized that I didn't even blink at this one.
- reaperducer 6y ago
  I might have glanced over "Develop App" having internally misread it as "Developer App" I bet many thousands of people on HN would have done the same thing. I think it's an issue with reading comprehension. In general, comprehension seems to have plummeted in the last five to ten years. I send people e-mails asking two questions, and only get the first one answered. People read a headline and think it means something other than what it says. Flamewars erupt online over something that nobody actually wrote, but someone thinks they saw. It seems to be rooted in the fact that these days people skim text, rather than read what is written. I don't know if it's because of general information overload, or a lack of attention to detail, or if the mindless scrolling of phone apps has trained us that visual impressions of words are good enough. Or, if I can put on my old man hat, maybe it's just that people aren't as good at reading as they think, and that if people looked at a book half as often as they look at their telephones, they might get some good reading practice.
  - StavrosK 6y ago
    It is also the case that people aren't as good at writing as they think. I've seen people write pages and pages of text to say a few simple things, don't separate the important from the unimportant, etc, and then wonder why others don't take 15 minutes out of their busy day to read the incessant, flavorless text until they find the actual point. A good way to write text where you're going to ask people for stuff is to write it in a top-down manner, where first of all you mention "I want X", then you quickly summarize what exactly you want and why, and then write a more detailed paragraph on the various nuances, always making sure to cut everything down to its absolute essentials.
    - akdas 6y ago
      I really like that style. It's related to the Inverted Pyramid style in journalism, meaning others have thought a lot about how to get important information up to the front of a piece of writing. https://en.wikipedia.org/wiki/Inverted_pyramid_(journalism) https://en.wikipedia.org/wiki/Inverted_pyramid_(journalism)
      - 6y ago
- StavrosK 6y ago
  Being an Android user, I looked for the developer's name, saw "Develop App" and thought it was a category and I was just mistaken about where on the page the developer's name was supposed to be. This was all instinctive, I didn't sit down to think about it, though. It doesn't help that the developer name and category have the exact same visual style, I guess.
- kn0where 6y ago
  The big red flag I saw was that “Tik Tok” is in the wrong font in every screenshot.
mrtksn 6y ago
>I'm curious if this fake TikTok app would probably have been blocked at the outset in the Apple App Store review process because it's trying to masquerade as another business ? I bet that it is possible to slip through the review process however there's also a safeguard on the developer account creation. Apple wouldn't let you create a developer account using vouchers, PayPal or prepaid cards, at least not from countries where scams are commonplace. Also you would be asked to provide documentation of company registration to have an account named “Develop App”. It is a common theme on HN to trash Apple on its "draconian restrictions" but the reality is that Apple AppStore is a safe place to be. You don't have to study the App before downloading it, you first download then decide if you want to keep it and security is never a concern. The Apple tax is something I am happy to pay for that luxury. I am a developer and I have no idea what com.acazira.tforbusiness means. What keeps it from being com.toktik.forbusiness? On AppStore this is something that you type it by yourself on the project configuration screen in XCode and I don't remember reading any restrictions about it, only recommendation to use reverse domain name notation to prevent conflicts.
- mekoka 6y ago
  It's not necessary nor useful to create a false dichotomy. The safety of the AppStore may be a reason to have a strict review policy, but it should not become an excuse to abuse of that policy. The price tag of safety is certainly some amount of freedom, but it's worrisome that people are learning to accept this without also distinguishing when this relationship is being usurped for other means.
  - noizejoy 6y ago
    If something simply doesn’t exist, how reasonable is it to assume that it could exist? How am I supposed to differentiate the statement that something could exist from fairytales?
- saagarjha 6y ago
  > I don't remember reading any restrictions about it You can never change it. This is how you get com.toyopagroup.picaboo (Snapchat) or com.yourcompany.TestWithCustomTabs (AccuWeather).
varispeed 6y ago
It's the problem of Facebook and PayPal that they have inadequate protections and blame the users for that. I think the issue is of allowing a payment to go through without triggering any security checks. Probably some basic checks should also be done whether a company publishing an app actually exist.
- luckylion 6y ago
  I wouldn't blame PayPal as much, this is on Facebook in my opinion. Recurring payments are a good thing, we don't want constant re-authorization when the relationship has been established. Facebook on the other hand should have handled it differently. I don't know how their permission screen for app authorization looks, but I guess it should have a huge red warning sign if it includes a permission to allow the app to spend your money.
  - varispeed 6y ago
    The problem is that people are now trained to click popup windows without reading the contents, just to make them go away thanks to brilliant GDPR and cookie law. I am not sure if a huge red warning sign would have helped. People are blind to these things.
brian_herman__ 6y ago
I don't know looking at the other parts the app looks legit, however TikTok asking for facebook login? That is where I would stop and think for a little bit.
- donmcronald 6y ago
  "Sign up for TikTok", "Continue with Facebook". It's literally the first screen you see from the official app, so it's not unbelievable. Social sign in is pervasive.
solinent 6y ago
I've actually stopped using google's spam filter and starting looking into the spam occasionally. With no data, if one slips through it shouldn't be up to the spam filter if I can be scammed! edit: that was a particularly bad typo to make. I mean scammed, not spammed :)
JAlexoid 6y ago
So.... False sense of security is OK, just because "Apple". Give me a break...
fencepost 6y ago
The gmail address as a red flag yes, but the package name? Nah. Given that a lot of companies outsource app development to third-party companies that in many cases mostly reskin and extend an existing app that they sell to many clients, a package name that could be from a development shop likely wouldn't cause concern. Sure Tik-Tok has a significant in-house development staff, but they're focused on the backend and client apps and Sales and Marketing may not have much access to them. It may be much easier for those departments to fully outsource that development to a vertical-market vendor, particularly if it's SaaS and the resulting app(s) aren't integrating with internal systems except via downloaded CSV files.
- bentcorner 6y ago
  And literally nothing stops someone from creating a tiktokforbusiness domain and fixing the developer name.
jrochkind1 6y ago
I believe they are saying they didn't NOTICE the "developgameonline@gmail.com developer email and com.acazira.tforbusiness package"; if they had, that would have raised alarm bells. I don't think these are visible on the page without clicking. "the developer name 'Develop App'" is visible, although I don't know how many pay attention to it. They are retrospectively thinking they probably should have thought that wasn't right, and motivated them to look further.
ggggtez 6y ago
>It's exhausting having to constantly second-guess every application you want to run. Maybe try to have a sip of coffee before jumping for that $3000. Let's not pretend that this is just ToS fatigue. The only reason they installed this app is for the free money. So yes, maybe if someone is offering you thousands of dollars, you should consider that to be the time to second-guess what's happening.
flavmartins 6y ago
Any free app I always look at the developer name. Generic name that looks like it could be trying to mislead? Always a bad sign. Who gets together and says, "I have the perfect name for a new dev shop: Develop Apps".
philliphaydon 6y ago
> I'm curious if this fake TikTok app would probably have been blocked at the outset in the Apple App Store review process because it's trying to masquerade as another business ? Maybe this is too risky to do on the Apple App Store because you need to /pay/ for an account to publish on the app store, which means you more or less need to verify yourself. Doing something like this would make it too easy to lead back to you and get in trouble?
Zenbit_UX 6y ago
The most experienced techies use adblockers which would have completely nullified this scam - OP does not fall into this group IMO.

actionowl 6y ago

Not being an android user and not being familiar with the Play story I might have glanced over "Develop App" having internally misread it as "Developer App" and thinking it was a category, not the developer's name.

NiekvdMaas 6y ago
Exactly this, it doesn't really stand out. Obviously I wouldn't have installed the app if I would have noticed.
- muststopmyths 6y ago
  I wasn't trying to excoriate you for your mistake, so I apologize if that's how it comes across. I did try to modulate the harshness of "Come on, dude" with the rest of my comment. Like I said, sometimes we let our guard down. So it's understandable if you got fooled. In hindsight there are more red flags in just that screenshot ("More by Develop App", obviously fake reviews to point out just two), but God knows I've clicked through installs for shit apps on iOS many times.
  - ShroudedNight 6y ago
    FWIW, Given the surrounding context, I interpreted "Come on, dude" as an exhortation for the author to cut themselves some slack. I agree that 100% correct 100% of the time is an exhausting bar to maintain, and one that we should be working very hard to ease this requirement. I think it's worth pointing out that the difficulty / impossibility of achieving that bar (at least in the general case) is one of, if not the central tenet of Christianity, ostensibly the dominant religion of the West for something like 1500 years. Regardless of one's metaphysical beliefs, it's worth remembering that arguments for the necessity of grace and slack in positive interactions have a long historical precedent, and I find we ignore them at our peril.
  - NiekvdMaas 6y ago
    No worries, no offense taken. I still can't believe myself I fell for this, as said I have 2FA on all accounts and I'm normally very cautious. I guess it's a combination of all the factors here at play: Facebook allowing a fake TikTok Ads advertiser, the ad looking very legit (referring to an existing ad credit program), Google allowing a fake TikTok Ads app with fake reviews, and not getting any notifications until the amount was charged from my PayPal account.
- donmcronald 6y ago
  I didn't notice it the first time I looked either :-( Bad spelling and grammar used to be a great indicator of something being amiss, but the volume of it in legit business these days has made me so desensitized that I didn't even blink at this one.
reaperducer 6y ago
I might have glanced over "Develop App" having internally misread it as "Developer App" I bet many thousands of people on HN would have done the same thing. I think it's an issue with reading comprehension. In general, comprehension seems to have plummeted in the last five to ten years. I send people e-mails asking two questions, and only get the first one answered. People read a headline and think it means something other than what it says. Flamewars erupt online over something that nobody actually wrote, but someone thinks they saw. It seems to be rooted in the fact that these days people skim text, rather than read what is written. I don't know if it's because of general information overload, or a lack of attention to detail, or if the mindless scrolling of phone apps has trained us that visual impressions of words are good enough. Or, if I can put on my old man hat, maybe it's just that people aren't as good at reading as they think, and that if people looked at a book half as often as they look at their telephones, they might get some good reading practice.
- StavrosK 6y ago
  It is also the case that people aren't as good at writing as they think. I've seen people write pages and pages of text to say a few simple things, don't separate the important from the unimportant, etc, and then wonder why others don't take 15 minutes out of their busy day to read the incessant, flavorless text until they find the actual point. A good way to write text where you're going to ask people for stuff is to write it in a top-down manner, where first of all you mention "I want X", then you quickly summarize what exactly you want and why, and then write a more detailed paragraph on the various nuances, always making sure to cut everything down to its absolute essentials.
  - akdas 6y ago
    I really like that style. It's related to the Inverted Pyramid style in journalism, meaning others have thought a lot about how to get important information up to the front of a piece of writing. https://en.wikipedia.org/wiki/Inverted_pyramid_(journalism) https://en.wikipedia.org/wiki/Inverted_pyramid_(journalism)
    - 6y ago
StavrosK 6y ago
Being an Android user, I looked for the developer's name, saw "Develop App" and thought it was a category and I was just mistaken about where on the page the developer's name was supposed to be. This was all instinctive, I didn't sit down to think about it, though. It doesn't help that the developer name and category have the exact same visual style, I guess.
kn0where 6y ago
The big red flag I saw was that “Tik Tok” is in the wrong font in every screenshot.

mrtksn 6y ago

>I'm curious if this fake TikTok app would probably have been blocked at the outset in the Apple App Store review process because it's trying to masquerade as another business ? I bet that it is possible to slip through the review process however there's also a safeguard on the developer account creation. Apple wouldn't let you create a developer account using vouchers, PayPal or prepaid cards, at least not from countries where scams are commonplace. Also you would be asked to provide documentation of company registration to have an account named “Develop App”. It is a common theme on HN to trash Apple on its "draconian restrictions" but the reality is that Apple AppStore is a safe place to be. You don't have to study the App before downloading it, you first download then decide if you want to keep it and security is never a concern. The Apple tax is something I am happy to pay for that luxury. I am a developer and I have no idea what com.acazira.tforbusiness means. What keeps it from being com.toktik.forbusiness? On AppStore this is something that you type it by yourself on the project configuration screen in XCode and I don't remember reading any restrictions about it, only recommendation to use reverse domain name notation to prevent conflicts.

mekoka 6y ago
It's not necessary nor useful to create a false dichotomy. The safety of the AppStore may be a reason to have a strict review policy, but it should not become an excuse to abuse of that policy. The price tag of safety is certainly some amount of freedom, but it's worrisome that people are learning to accept this without also distinguishing when this relationship is being usurped for other means.
- noizejoy 6y ago
  If something simply doesn’t exist, how reasonable is it to assume that it could exist? How am I supposed to differentiate the statement that something could exist from fairytales?
saagarjha 6y ago
> I don't remember reading any restrictions about it You can never change it. This is how you get com.toyopagroup.picaboo (Snapchat) or com.yourcompany.TestWithCustomTabs (AccuWeather).

varispeed 6y ago

It's the problem of Facebook and PayPal that they have inadequate protections and blame the users for that. I think the issue is of allowing a payment to go through without triggering any security checks. Probably some basic checks should also be done whether a company publishing an app actually exist.

luckylion 6y ago
I wouldn't blame PayPal as much, this is on Facebook in my opinion. Recurring payments are a good thing, we don't want constant re-authorization when the relationship has been established. Facebook on the other hand should have handled it differently. I don't know how their permission screen for app authorization looks, but I guess it should have a huge red warning sign if it includes a permission to allow the app to spend your money.
- varispeed 6y ago
  The problem is that people are now trained to click popup windows without reading the contents, just to make them go away thanks to brilliant GDPR and cookie law. I am not sure if a huge red warning sign would have helped. People are blind to these things.

brian_herman__ 6y ago

I don't know looking at the other parts the app looks legit, however TikTok asking for facebook login? That is where I would stop and think for a little bit.

donmcronald 6y ago
"Sign up for TikTok", "Continue with Facebook". It's literally the first screen you see from the official app, so it's not unbelievable. Social sign in is pervasive.

solinent 6y ago

I've actually stopped using google's spam filter and starting looking into the spam occasionally. With no data, if one slips through it shouldn't be up to the spam filter if I can be scammed! edit: that was a particularly bad typo to make. I mean scammed, not spammed :)

JAlexoid 6y ago

So.... False sense of security is OK, just because "Apple". Give me a break...

fencepost 6y ago

The gmail address as a red flag yes, but the package name? Nah. Given that a lot of companies outsource app development to third-party companies that in many cases mostly reskin and extend an existing app that they sell to many clients, a package name that could be from a development shop likely wouldn't cause concern. Sure Tik-Tok has a significant in-house development staff, but they're focused on the backend and client apps and Sales and Marketing may not have much access to them. It may be much easier for those departments to fully outsource that development to a vertical-market vendor, particularly if it's SaaS and the resulting app(s) aren't integrating with internal systems except via downloaded CSV files.

bentcorner 6y ago
And literally nothing stops someone from creating a tiktokforbusiness domain and fixing the developer name.

jrochkind1 6y ago

I believe they are saying they didn't NOTICE the "developgameonline@gmail.com developer email and com.acazira.tforbusiness package"; if they had, that would have raised alarm bells. I don't think these are visible on the page without clicking. "the developer name 'Develop App'" is visible, although I don't know how many pay attention to it. They are retrospectively thinking they probably should have thought that wasn't right, and motivated them to look further.

ggggtez 6y ago

>It's exhausting having to constantly second-guess every application you want to run. Maybe try to have a sip of coffee before jumping for that $3000. Let's not pretend that this is just ToS fatigue. The only reason they installed this app is for the free money. So yes, maybe if someone is offering you thousands of dollars, you should consider that to be the time to second-guess what's happening.

flavmartins 6y ago

Any free app I always look at the developer name. Generic name that looks like it could be trying to mislead? Always a bad sign. Who gets together and says, "I have the perfect name for a new dev shop: Develop Apps".

philliphaydon 6y ago

> I'm curious if this fake TikTok app would probably have been blocked at the outset in the Apple App Store review process because it's trying to masquerade as another business ? Maybe this is too risky to do on the Apple App Store because you need to /pay/ for an account to publish on the app store, which means you more or less need to verify yourself. Doing something like this would make it too easy to lead back to you and get in trouble?

Zenbit_UX 6y ago

The most experienced techies use adblockers which would have completely nullified this scam - OP does not fall into this group IMO.