6 ms·

If I put an extra bit of tinfoil on my hat, I might speculate this is actually encouraged by the CIA/NSA/FBI or similar parties. Certainly, they now have the o

by rocqua 5y ago

If I put an extra bit of tinfoil on my hat, I might speculate this is actually encouraged by the CIA/NSA/FBI or similar parties. Certainly, they now have the option of trying to force google into delivering modified apps to certain people. This situation changes the trust model for e.g. signal from "do you trust the app developer" to "do you trust google" against the pressures of hacking and legal requirement of cooperation. The fact that reproducible builds become _that much_ more difficult with this is extra bad. It takes away a rather effective "after the fact" detection mechanism for these kinds of abuses. It seems obvious to me there are plenty of important app developers (like signal) that are less likely to bow before the long arm of the US than the google play store. Also because for a principled developer, their app is likely 100% of their business. Whereas for google, any app is only a small part of their business. Google simply has much less incentive to defend the users of a single app that the developer. Hence, it seems to me that this situation is realistically going to lead to more ways for law enforcement to access secret data on your devices. Whether this is part of the motivation for this change or not, the effect seems unavoidable.

roody15 5y ago
No tinfoil needed here. This is exactly what is happening.
- dredmorbius 5y ago
  Source?
  - selfhoster11 5y ago
    Did you need any source for NSA/CIA spying before the Snowden revelations? It was an open secret. No quotable sources, but lo and behold, they were doing it.
    - dredmorbius 5y ago
      A simple "no" would be sufficient. Do you, or OP, have any sources? Regards pre-Snowden, the situation was far more than an "open secret", there were multiple documented projects and methods employed. Among them: - 2013: Hemisphere, an AT&T call records database dating to the 1980s accessible by the US DEA. (This was publicised near-simultaneously with Snowden's own 2013 disclosures.) https://www.eff.org/cases/hemisphere https://www.eff.org/cases/hemisphere - 2006: Mark Klein and the Room 641A revelations concerning AT&T's beam splitters: https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A - 2005, William Binney and J. Kirk Wiebe, NSA whistleblower, warrantless surveillance. https://en.wikipedia.org/wiki/William_Binney_(intelligence_official) https://en.wikipedia.org/wiki/William_Binney_(intelligence_o... - 2004, Russell Tice, NSA surveillance including of congressional members. https://slate.com/news-and-politics/2006/01/why-nsa-whistle-blower-russ-tice-may-be-right.html https://slate.com/news-and-politics/2006/01/why-nsa-whistle-... There were very strong suspicions around the TIA (total information awareness) and USA PATRIOT ACT (2003, 2001). I recall much chatter about this at the time, and the related FISA court, though little by way of specific details of technological measures and methods involved. Carnivore, a WinNT workstation-based tool, disclosed ~2000. https://en.wikipedia.org/wiki/Carnivore_(software) https://en.wikipedia.org/wiki/Carnivore_(software) There are telephnic data retention programmes, including MAINWAY (revealed in 2006), containing an estimated over 1.9 trillion call-detail records, and https://en.wikipedia.org/wiki/MAINWAY https://en.wikipedia.org/wiki/MAINWAY Project ECHELON, with disclosures of varying aspects from 1972 -- 2000. https://en.wikipedia.org/wiki/ECHELON https://en.wikipedia.org/wiki/ECHELON There are earlier periods, notably addressed by the FBI's own COINTELPRO archives (https://vault.fbi.gov/cointel-pro https://vault.fbi.gov/cointel-pro), though for my purposes I'm considering "modern" projects to be circa 1990 onwards. (COINTELPRO and the Church Committee hearings resulted in substantial changes, at least publically, to US domestic surveillance). And I've compiled a long list of pre-1990 references of concerns regarding significant technologists who'd warned of the risks of information technology as a tool of surveillance and control, largely as no such list seemed extant: https://toot.cat/@dredmorbius/105074933053020193 https://toot.cat/@dredmorbius/105074933053020193 I'm well aware that documentation of clandestine and national security issues is difficult to come by, see the TK case for one reason why that is. But that's also why specific documentation is so valuable and why I'd requested that.
willvarfar 5y ago
The OS and App Store already control the code you download. If the App Store replaces one binary provided by the developer with another that isn’t, it already can. Whether it is signed by the developer or the store doesn’t change that. Of course whoever controls the OS and app stores can already access all device data. They don’t need to fiddle with the apps to do that. Who signs what doesn’t change the threat models.
- Avamander 5y ago
  The difference in the ability to detect it and the fact that if Google Play locks your access to publishing, you can't update the app any more because you don't have the keys.
  - willvarfar 5y ago
    They control the UI that shows you the certificates too. Signing gives some semblance of control between the untrusted developer and the trusted App Store. It doesn’t do more that stop 3rd party app stores on the link between store and phone.
    - Judgmentality 5y ago
      > They control the UI that shows you the certificates too. Sure, but if they lied about that isn't it an open-and-shut case of fraud? What they're doing here instead is obfuscating away everything behind an announcement, so there is no legal recourse for the consumer against their bullshit. The best we can do is hope an anti-trust suit is brought against Google (I have approximately zero hope of it happening because of this, though).
      - matthewowen 5y ago
        You’re in a thread that starts with the premise that this is a vehicle that the fbi/cia are going to use to distribute backfired versions of apps like signal, in which case no, it’s not an open and shut case of fraud.
fallingknife 5y ago
The developer would still be able to post the shasum though, right? If so this would still be detectable.
- izacus 5y ago
  Thing is, Google wants to repackage the apps to lower and optimize download sizes. The developer can't know what SHA hash of an optimized partial bundle is.
  - dbrgn 5y ago
    Yup, I'm pretty sure this makes reproducible builds totally impractical for any apps installed through the Play Store. Apps that currently provide reproducible builds: Signal, Threema, Telegram. (Probably others as well.)
  - pdkl95 5y ago
    If "optimize[d] download sizes" is the goal, Google could simply release a tool that performed the compression/etc on a bundle (pre-signing) and require[1] that apps must be processed by the tool before submission. [1] Google could easily verify this by making the tool output a fixed point; running the tool on an already processed bundle shouldn't change anything.
    - Gaelan 5y ago
      That doesn't work if there's a large and possibly growing matrix of hardware/OS/whatever combinations they're trying to optimize for.
      - pdkl95 5y ago
        I've only mentioned one example of how such a tool could work. There are many ways this typ0e of system could be designed. For an alternative that doesn't depend on the number of output combinations, see GauntletWizard's example[1] that uses a signed manifest of files. [1] https://news.ycombinator.com/item?id=27177425 https://news.ycombinator.com/item?id=27177425
gnfargbl 5y ago
The logical next step is for the developers of Signal, etc, to begin bundling instrumentation code that checks and monitors app execution. I wonder if Google will allow that level of runtime profiling, or if it will become against the Play store rules?
- UncleMeat 5y ago
  This sort of thing is incredibly common and has been for years, especially in Chinese markets. Because you can just extract bytecode from downloaded apps, people try to protect their IP by doing all sorts of runtime inspection to look for repacking.
nos4two 5y ago
One of the alphabet agencies is incompetent. I recently looked at my iPhone to see battery usage per app - and Facebook nearly used all of my battery for two days. Weird thing, Facebook is not installed, nor any subsidiary on my phone (Instagram, Whatsapp).

by rocqua 5y ago

roody15 5y ago

No tinfoil needed here. This is exactly what is happening.

dredmorbius 5y ago
Source?
- selfhoster11 5y ago
  Did you need any source for NSA/CIA spying before the Snowden revelations? It was an open secret. No quotable sources, but lo and behold, they were doing it.
  - dredmorbius 5y ago
    A simple "no" would be sufficient. Do you, or OP, have any sources? Regards pre-Snowden, the situation was far more than an "open secret", there were multiple documented projects and methods employed. Among them: - 2013: Hemisphere, an AT&T call records database dating to the 1980s accessible by the US DEA. (This was publicised near-simultaneously with Snowden's own 2013 disclosures.) https://www.eff.org/cases/hemisphere https://www.eff.org/cases/hemisphere - 2006: Mark Klein and the Room 641A revelations concerning AT&T's beam splitters: https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A - 2005, William Binney and J. Kirk Wiebe, NSA whistleblower, warrantless surveillance. https://en.wikipedia.org/wiki/William_Binney_(intelligence_official) https://en.wikipedia.org/wiki/William_Binney_(intelligence_o... - 2004, Russell Tice, NSA surveillance including of congressional members. https://slate.com/news-and-politics/2006/01/why-nsa-whistle-blower-russ-tice-may-be-right.html https://slate.com/news-and-politics/2006/01/why-nsa-whistle-... There were very strong suspicions around the TIA (total information awareness) and USA PATRIOT ACT (2003, 2001). I recall much chatter about this at the time, and the related FISA court, though little by way of specific details of technological measures and methods involved. Carnivore, a WinNT workstation-based tool, disclosed ~2000. https://en.wikipedia.org/wiki/Carnivore_(software) https://en.wikipedia.org/wiki/Carnivore_(software) There are telephnic data retention programmes, including MAINWAY (revealed in 2006), containing an estimated over 1.9 trillion call-detail records, and https://en.wikipedia.org/wiki/MAINWAY https://en.wikipedia.org/wiki/MAINWAY Project ECHELON, with disclosures of varying aspects from 1972 -- 2000. https://en.wikipedia.org/wiki/ECHELON https://en.wikipedia.org/wiki/ECHELON There are earlier periods, notably addressed by the FBI's own COINTELPRO archives (https://vault.fbi.gov/cointel-pro https://vault.fbi.gov/cointel-pro), though for my purposes I'm considering "modern" projects to be circa 1990 onwards. (COINTELPRO and the Church Committee hearings resulted in substantial changes, at least publically, to US domestic surveillance). And I've compiled a long list of pre-1990 references of concerns regarding significant technologists who'd warned of the risks of information technology as a tool of surveillance and control, largely as no such list seemed extant: https://toot.cat/@dredmorbius/105074933053020193 https://toot.cat/@dredmorbius/105074933053020193 I'm well aware that documentation of clandestine and national security issues is difficult to come by, see the TK case for one reason why that is. But that's also why specific documentation is so valuable and why I'd requested that.

willvarfar 5y ago

The OS and App Store already control the code you download. If the App Store replaces one binary provided by the developer with another that isn’t, it already can. Whether it is signed by the developer or the store doesn’t change that. Of course whoever controls the OS and app stores can already access all device data. They don’t need to fiddle with the apps to do that. Who signs what doesn’t change the threat models.

Avamander 5y ago
The difference in the ability to detect it and the fact that if Google Play locks your access to publishing, you can't update the app any more because you don't have the keys.
- willvarfar 5y ago
  They control the UI that shows you the certificates too. Signing gives some semblance of control between the untrusted developer and the trusted App Store. It doesn’t do more that stop 3rd party app stores on the link between store and phone.
  - Judgmentality 5y ago
    > They control the UI that shows you the certificates too. Sure, but if they lied about that isn't it an open-and-shut case of fraud? What they're doing here instead is obfuscating away everything behind an announcement, so there is no legal recourse for the consumer against their bullshit. The best we can do is hope an anti-trust suit is brought against Google (I have approximately zero hope of it happening because of this, though).
    - matthewowen 5y ago
      You’re in a thread that starts with the premise that this is a vehicle that the fbi/cia are going to use to distribute backfired versions of apps like signal, in which case no, it’s not an open and shut case of fraud.

fallingknife 5y ago

The developer would still be able to post the shasum though, right? If so this would still be detectable.

izacus 5y ago
Thing is, Google wants to repackage the apps to lower and optimize download sizes. The developer can't know what SHA hash of an optimized partial bundle is.
- dbrgn 5y ago
  Yup, I'm pretty sure this makes reproducible builds totally impractical for any apps installed through the Play Store. Apps that currently provide reproducible builds: Signal, Threema, Telegram. (Probably others as well.)
- pdkl95 5y ago
  If "optimize[d] download sizes" is the goal, Google could simply release a tool that performed the compression/etc on a bundle (pre-signing) and require[1] that apps must be processed by the tool before submission. [1] Google could easily verify this by making the tool output a fixed point; running the tool on an already processed bundle shouldn't change anything.
  - Gaelan 5y ago
    That doesn't work if there's a large and possibly growing matrix of hardware/OS/whatever combinations they're trying to optimize for.
    - pdkl95 5y ago
      I've only mentioned one example of how such a tool could work. There are many ways this typ0e of system could be designed. For an alternative that doesn't depend on the number of output combinations, see GauntletWizard's example[1] that uses a signed manifest of files. [1] https://news.ycombinator.com/item?id=27177425 https://news.ycombinator.com/item?id=27177425

gnfargbl 5y ago

The logical next step is for the developers of Signal, etc, to begin bundling instrumentation code that checks and monitors app execution. I wonder if Google will allow that level of runtime profiling, or if it will become against the Play store rules?

UncleMeat 5y ago
This sort of thing is incredibly common and has been for years, especially in Chinese markets. Because you can just extract bytecode from downloaded apps, people try to protect their IP by doing all sorts of runtime inspection to look for repacking.

nos4two 5y ago

One of the alphabet agencies is incompetent. I recently looked at my iPhone to see battery usage per app - and Facebook nearly used all of my battery for two days. Weird thing, Facebook is not installed, nor any subsidiary on my phone (Instagram, Whatsapp).