8 ms·

The OS and App Store already control the code you download. If the App Store replaces one binary provided by the developer with another that isn’t, it already

The OS and App Store already control the code you download. If the App Store replaces one binary provided by the developer with another that isn’t, it already can. Whether it is signed by the developer or the store doesn’t change that. Of course whoever controls the OS and app stores can already access all device data. They don’t need to fiddle with the apps to do that. Who signs what doesn’t change the threat models.

Avamander 5y ago
The difference in the ability to detect it and the fact that if Google Play locks your access to publishing, you can't update the app any more because you don't have the keys.
- willvarfar 5y ago
  They control the UI that shows you the certificates too. Signing gives some semblance of control between the untrusted developer and the trusted App Store. It doesn’t do more that stop 3rd party app stores on the link between store and phone.
  - Judgmentality 5y ago
    > They control the UI that shows you the certificates too. Sure, but if they lied about that isn't it an open-and-shut case of fraud? What they're doing here instead is obfuscating away everything behind an announcement, so there is no legal recourse for the consumer against their bullshit. The best we can do is hope an anti-trust suit is brought against Google (I have approximately zero hope of it happening because of this, though).
    - matthewowen 5y ago
      You’re in a thread that starts with the premise that this is a vehicle that the fbi/cia are going to use to distribute backfired versions of apps like signal, in which case no, it’s not an open and shut case of fraud.
      - dane-pgp 5y ago
        That's actually a good point. If the US government issues a National Security Letter or uses the All Writs Act to force Google to distribute a backdoored version of an app to a target of a criminal investigation, then it might be an open and shut case of compelled speech (challenged under the First Amendment, assuming the target had standing), but it's not obvious that actions done by a private company to fulfil a legal obligation from the government can ever be prosecuted as fraud. It might be helpful to consider a simpler situation, where an FBI agent pretends to have a shipment of drugs which a drug dealer attempts to buy. If the dealer hands over money and doesn't receive the drugs, my non-expert understanding is that they can't then sue the government for fraud, presumably because of qualified or sovereign immunity. The reason the government won't give back the money is that it will initially be evidence, and then subject to civil asset forfeiture. I don't believe that it matters that the item being bought was illegal, as if property law doesn't apply to illegal goods, since, in theory, if one drug dealer stole drugs from another drug dealer, the government could prosecute the perpetrator for both the theft and the possession of the drugs.
      - Judgmentality 5y ago
        If it were ever presented in front of a judge it would be considered fraud. The FBI and CIA will go to extraordinary lengths to never actually have to face a judge, because they know what they are doing is illegal and their entire defense is obfuscation of the law. Even the police are doing this today to avoid ever having to face scrutiny over their use of STINGRAY devices. And when it does find its way in front of a judge, the judge gives them the proverbial "fuck you" https://arstechnica.com/tech-policy/2018/07/judge-slams-fbi-for-improper-cellphone-search-stingray-use/ https://arstechnica.com/tech-policy/2018/07/judge-slams-fbi-... People have this notion that the court system just blindly agrees with three lettered agencies, when in reality they tend to hate each other.
  - Avamander 5y ago
    > They control the UI that shows you the certificates too. The Android system one that comes from the OEM? Or have they compromised the Java installation I have? The latter being very difficult for Google alone to make output incorrect results.
  - rocqua 5y ago
    > They control the UI that shows you the certificates too. Really? They wrote the code for a part of it, sure. But that code was compiled by my OEM, and modified to put the OEM's extra little bit of sauce on there. Besides, the certificates aren't shown to me. They are used by the OS itself to verify updates to the app. Currently, signing gives control between a trusted developer of an app and any updates reaching my phone. This is enforced at the OS level. That means that the app store cannot just ship my phone false updates. At least, unless they can exploit the currently installed OS.
rocqua 5y ago
With google play store, an _update_ to an app needs to be signed with the same keys as the original app. Hence, google play store cannot just give my an updated backdoored version of signal or whatsapp unless they can get those developers to sign it. With this new system google could unilaterally decide to push such an update. Either to everyone, or just to a few select people. > Who signs what doesn’t change the threat models. It very VERY much does. He who signs is he who is able to modify code. If it did not, what value do signatures even have? It seems you are arguing that, since google already controls android, they already control this data anyway. Thing is, the OS on my phone is already on there. Updates need to go through the manufacturer, and are hard to target. The play-store itself cannot read my signal messages. Hence, for google to read my signal messages, right now, they would need to have a pre-existing backdoor in android, or run an exploit through the play-store. With the new system, they could just push an update to my signal app. (If signal were to use the new system). That, in my opinion, warrants changing the threat model quite a bit.
- capableweb 5y ago
  > With google play store, an _update_ to an app needs to be signed with the same keys as the original app. Sure, just like how if you let's say own Google Play Store and own those updating keys, you can change it (selectively most likely) to skip checking the signed updates. They own the full pipeline so if they want, you really stand no chance unless you're running your own OS.
  - twobitshifter 5y ago
    This happens on the OS level not play store.You can see it yourself if you try to install a release version over a debug version on your phone.
  - rocqua 5y ago
    > Sure, just like how if you let's say own Google Play Store and own those updating keys The ENTIRE POINT, of this scare is that currently, google does not have access to those keys, developers do. And the signatures on these apps are checked by the OS, not the play store. Notably, google can't change the OS on my phone at their whim. They'd need to release a new version and get Samsung (and maybe my carrier) to ship that OS to me.

Avamander 5y ago

The difference in the ability to detect it and the fact that if Google Play locks your access to publishing, you can't update the app any more because you don't have the keys.

willvarfar 5y ago
They control the UI that shows you the certificates too. Signing gives some semblance of control between the untrusted developer and the trusted App Store. It doesn’t do more that stop 3rd party app stores on the link between store and phone.
- Judgmentality 5y ago
  > They control the UI that shows you the certificates too. Sure, but if they lied about that isn't it an open-and-shut case of fraud? What they're doing here instead is obfuscating away everything behind an announcement, so there is no legal recourse for the consumer against their bullshit. The best we can do is hope an anti-trust suit is brought against Google (I have approximately zero hope of it happening because of this, though).
  - matthewowen 5y ago
    You’re in a thread that starts with the premise that this is a vehicle that the fbi/cia are going to use to distribute backfired versions of apps like signal, in which case no, it’s not an open and shut case of fraud.
    - dane-pgp 5y ago
      That's actually a good point. If the US government issues a National Security Letter or uses the All Writs Act to force Google to distribute a backdoored version of an app to a target of a criminal investigation, then it might be an open and shut case of compelled speech (challenged under the First Amendment, assuming the target had standing), but it's not obvious that actions done by a private company to fulfil a legal obligation from the government can ever be prosecuted as fraud. It might be helpful to consider a simpler situation, where an FBI agent pretends to have a shipment of drugs which a drug dealer attempts to buy. If the dealer hands over money and doesn't receive the drugs, my non-expert understanding is that they can't then sue the government for fraud, presumably because of qualified or sovereign immunity. The reason the government won't give back the money is that it will initially be evidence, and then subject to civil asset forfeiture. I don't believe that it matters that the item being bought was illegal, as if property law doesn't apply to illegal goods, since, in theory, if one drug dealer stole drugs from another drug dealer, the government could prosecute the perpetrator for both the theft and the possession of the drugs.
    - Judgmentality 5y ago
      If it were ever presented in front of a judge it would be considered fraud. The FBI and CIA will go to extraordinary lengths to never actually have to face a judge, because they know what they are doing is illegal and their entire defense is obfuscation of the law. Even the police are doing this today to avoid ever having to face scrutiny over their use of STINGRAY devices. And when it does find its way in front of a judge, the judge gives them the proverbial "fuck you" https://arstechnica.com/tech-policy/2018/07/judge-slams-fbi-for-improper-cellphone-search-stingray-use/ https://arstechnica.com/tech-policy/2018/07/judge-slams-fbi-... People have this notion that the court system just blindly agrees with three lettered agencies, when in reality they tend to hate each other.
- Avamander 5y ago
  > They control the UI that shows you the certificates too. The Android system one that comes from the OEM? Or have they compromised the Java installation I have? The latter being very difficult for Google alone to make output incorrect results.
- rocqua 5y ago
  > They control the UI that shows you the certificates too. Really? They wrote the code for a part of it, sure. But that code was compiled by my OEM, and modified to put the OEM's extra little bit of sauce on there. Besides, the certificates aren't shown to me. They are used by the OS itself to verify updates to the app. Currently, signing gives control between a trusted developer of an app and any updates reaching my phone. This is enforced at the OS level. That means that the app store cannot just ship my phone false updates. At least, unless they can exploit the currently installed OS.

rocqua 5y ago

With google play store, an _update_ to an app needs to be signed with the same keys as the original app. Hence, google play store cannot just give my an updated backdoored version of signal or whatsapp unless they can get those developers to sign it. With this new system google could unilaterally decide to push such an update. Either to everyone, or just to a few select people. > Who signs what doesn’t change the threat models. It very VERY much does. He who signs is he who is able to modify code. If it did not, what value do signatures even have? It seems you are arguing that, since google already controls android, they already control this data anyway. Thing is, the OS on my phone is already on there. Updates need to go through the manufacturer, and are hard to target. The play-store itself cannot read my signal messages. Hence, for google to read my signal messages, right now, they would need to have a pre-existing backdoor in android, or run an exploit through the play-store. With the new system, they could just push an update to my signal app. (If signal were to use the new system). That, in my opinion, warrants changing the threat model quite a bit.

capableweb 5y ago
> With google play store, an _update_ to an app needs to be signed with the same keys as the original app. Sure, just like how if you let's say own Google Play Store and own those updating keys, you can change it (selectively most likely) to skip checking the signed updates. They own the full pipeline so if they want, you really stand no chance unless you're running your own OS.
- twobitshifter 5y ago
  This happens on the OS level not play store.You can see it yourself if you try to install a release version over a debug version on your phone.
- rocqua 5y ago
  > Sure, just like how if you let's say own Google Play Store and own those updating keys The ENTIRE POINT, of this scare is that currently, google does not have access to those keys, developers do. And the signatures on these apps are checked by the OS, not the play store. Notably, google can't change the OS on my phone at their whim. They'd need to release a new version and get Samsung (and maybe my carrier) to ship that OS to me.