4 ms·

Disagree. If a developer signs a build, then I can verify the build came from the developer. If it is signed by Google, then who knows what may have been insert

Disagree. If a developer signs a build, then I can verify the build came from the developer. If it is signed by Google, then who knows what may have been inserted into the app. This is especially bad for open source and security conscious apps.

izacus 5y ago
Google literally controls the software delivery platform and silently updates a highly privileged service called Play Services on every phone. That service can access and backup data from apps private storage. They really really don't need to touch your APK to get any user or app data. If you don't realize that, you may have been thinking of wrong threat models.
- sltkr 5y ago
  Apps have control over which data they allow to be backed up, and this is controlled by the OS, not the Google Play Store.
nodamage 5y ago
Verifying that the build came from the developer tells you nothing about whether the app has been backdoored when your adversary controls the compiler used to build the app and the operating system used to execute the app. Reflections on Trusting Trust explains why: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
- gruez 5y ago
  If the SDK was backdoored it would show up on everyone's downloads, which greatly increases the chances of detection. Conversely, if the binaries were uploaded to an app store and were only signed by the app store itself, it's impossible to know whether you got a backdoored version or not.
  - Skunkleton 5y ago
    What do you mean it would "show up in everyones downloads"? Google Play Services are constantly being updated on peoples phones. Literally nothing besides Google's decision not to prevents these updates from containing a backdoor.
    - Avamander 5y ago
      Google Play Services is still bound by Android's own security mechanisms, it can't do everything but it can do a lot, yes.
      - izacus 5y ago
        It can silently replace APKs which is exactly what the conversation here is about. It's more than enough.
        Avamander 5y ago
        It can't. It can uninstall them, but then the app doesn't have any data after reinstallation.
        iggldiggl 5y ago
        I have no idea whether there are any APIs the Play Store has access to which expose that feature, but through ADB (or directly calling the package manager from the shell of a rooted device) you have been able to instruct Android to keep the app data even after uninstalling for a long time already. (I haven't actually tried whether you can really successfully switch signatures on an APK that way without losing all user data, tough) Additionally, starting from Android 10 it seems that there is a new official feature allowing data to be kept after uninstallation if an app opts-in (https://stackoverflow.com/questions/58750567/how-to-enable-option-to-keep-apps-data-on-uninstall-prompt https://stackoverflow.com/questions/58750567/how-to-enable-o...).
        dbrgn 5y ago
UncleMeat 5y ago
Have you ever checked the signing key on an app downloaded from Play? What developers even publish their public keys on the web?
- dbrgn 5y ago
  This is mostly about updates (TOFU): If the OS installs the update, then you know it comes from the same developer.
- rocqua 5y ago
  Android has done it for me every time I install an update to an app.
  - UncleMeat 5y ago
    Have you checked? Because people here are claiming that Google is an adversary in their threat models. So you can't just assume that the OS actually did verify the signing key. Or perhaps it makes more sense to not consider the developer of your operating system to be adversarial.
    - lol768 5y ago
      > Have you checked? Yes, I've stripped, patched and re-signed apps and verified that installing them as an update failed. For various reasons I think it's reasonable to assume it's more difficult to be running a phone with a compromised OS (particularly given the bootloader is unlockable and you can install a 100% OSS ROM) than to assume the Play store is not serving something malicious.
    - rocqua 5y ago
      Google is not some monolithic entity. And my android install is not under direct control by google (barring some back-door they installed). If google wants to change my android OS, they need to go through the play-store, or through Samsung to push an update. Those are difficult things to do. The play-store should still be bound by the OS, as it is simply an application. And going through samsung to deliver me a targeted update seems quite difficult and involves another party. Besides, the worry is not "Google Evil". The worry is "Google might be coerced into compromising a specific user". For that usecase, presuming google is _not_ evil and has not backdoored pre-existing android installs, signed updates to apps actually help a lot. As a matter of legal theory, forcing google to backdoor android / the play-store is so much harder than forcing google to just sign this one update of an app. This is not about "protecting ourselves from Google". This is about making it as hard as possible for google to do bad things, so it is harder for outsiders to influence Google. I think that, for the argument you are making, the play-store is the strongest point. I am unsure of how deep the privileges of the play-store run, but it has more control than most apps, and is easily google controlled. I suspect that google would still need to run an exploit against android OS to actually get e.g. my signal messages.

izacus 5y ago

Google literally controls the software delivery platform and silently updates a highly privileged service called Play Services on every phone. That service can access and backup data from apps private storage. They really really don't need to touch your APK to get any user or app data. If you don't realize that, you may have been thinking of wrong threat models.

sltkr 5y ago
Apps have control over which data they allow to be backed up, and this is controlled by the OS, not the Google Play Store.

nodamage 5y ago

Verifying that the build came from the developer tells you nothing about whether the app has been backdoored when your adversary controls the compiler used to build the app and the operating system used to execute the app. Reflections on Trusting Trust explains why: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_ReflectionsonTrustingTrust.pdf https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...

gruez 5y ago
If the SDK was backdoored it would show up on everyone's downloads, which greatly increases the chances of detection. Conversely, if the binaries were uploaded to an app store and were only signed by the app store itself, it's impossible to know whether you got a backdoored version or not.
- Skunkleton 5y ago
  What do you mean it would "show up in everyones downloads"? Google Play Services are constantly being updated on peoples phones. Literally nothing besides Google's decision not to prevents these updates from containing a backdoor.
  - Avamander 5y ago
    Google Play Services is still bound by Android's own security mechanisms, it can't do everything but it can do a lot, yes.
    - izacus 5y ago
      It can silently replace APKs which is exactly what the conversation here is about. It's more than enough.
      - Avamander 5y ago
        It can't. It can uninstall them, but then the app doesn't have any data after reinstallation.
        iggldiggl 5y ago
        I have no idea whether there are any APIs the Play Store has access to which expose that feature, but through ADB (or directly calling the package manager from the shell of a rooted device) you have been able to instruct Android to keep the app data even after uninstalling for a long time already. (I haven't actually tried whether you can really successfully switch signatures on an APK that way without losing all user data, tough) Additionally, starting from Android 10 it seems that there is a new official feature allowing data to be kept after uninstallation if an app opts-in (https://stackoverflow.com/questions/58750567/how-to-enable-option-to-keep-apps-data-on-uninstall-prompt https://stackoverflow.com/questions/58750567/how-to-enable-o...).
      - dbrgn 5y ago

UncleMeat 5y ago

Have you ever checked the signing key on an app downloaded from Play? What developers even publish their public keys on the web?

dbrgn 5y ago
This is mostly about updates (TOFU): If the OS installs the update, then you know it comes from the same developer.
rocqua 5y ago
Android has done it for me every time I install an update to an app.
- UncleMeat 5y ago
  Have you checked? Because people here are claiming that Google is an adversary in their threat models. So you can't just assume that the OS actually did verify the signing key. Or perhaps it makes more sense to not consider the developer of your operating system to be adversarial.
  - lol768 5y ago
    > Have you checked? Yes, I've stripped, patched and re-signed apps and verified that installing them as an update failed. For various reasons I think it's reasonable to assume it's more difficult to be running a phone with a compromised OS (particularly given the bootloader is unlockable and you can install a 100% OSS ROM) than to assume the Play store is not serving something malicious.
  - rocqua 5y ago
    Google is not some monolithic entity. And my android install is not under direct control by google (barring some back-door they installed). If google wants to change my android OS, they need to go through the play-store, or through Samsung to push an update. Those are difficult things to do. The play-store should still be bound by the OS, as it is simply an application. And going through samsung to deliver me a targeted update seems quite difficult and involves another party. Besides, the worry is not "Google Evil". The worry is "Google might be coerced into compromising a specific user". For that usecase, presuming google is _not_ evil and has not backdoored pre-existing android installs, signed updates to apps actually help a lot. As a matter of legal theory, forcing google to backdoor android / the play-store is so much harder than forcing google to just sign this one update of an app. This is not about "protecting ourselves from Google". This is about making it as hard as possible for google to do bad things, so it is harder for outsiders to influence Google. I think that, for the argument you are making, the play-store is the strongest point. I am unsure of how deep the privileges of the play-store run, but it has more control than most apps, and is easily google controlled. I suspect that google would still need to run an exploit against android OS to actually get e.g. my signal messages.