5 ms·

They control the UI that shows you the certificates too. Signing gives some semblance of control between the untrusted developer and the trusted App Store. It

They control the UI that shows you the certificates too. Signing gives some semblance of control between the untrusted developer and the trusted App Store. It doesn’t do more that stop 3rd party app stores on the link between store and phone.

Judgmentality 5y ago
> They control the UI that shows you the certificates too. Sure, but if they lied about that isn't it an open-and-shut case of fraud? What they're doing here instead is obfuscating away everything behind an announcement, so there is no legal recourse for the consumer against their bullshit. The best we can do is hope an anti-trust suit is brought against Google (I have approximately zero hope of it happening because of this, though).
- matthewowen 5y ago
  You’re in a thread that starts with the premise that this is a vehicle that the fbi/cia are going to use to distribute backfired versions of apps like signal, in which case no, it’s not an open and shut case of fraud.
  - dane-pgp 5y ago
    That's actually a good point. If the US government issues a National Security Letter or uses the All Writs Act to force Google to distribute a backdoored version of an app to a target of a criminal investigation, then it might be an open and shut case of compelled speech (challenged under the First Amendment, assuming the target had standing), but it's not obvious that actions done by a private company to fulfil a legal obligation from the government can ever be prosecuted as fraud. It might be helpful to consider a simpler situation, where an FBI agent pretends to have a shipment of drugs which a drug dealer attempts to buy. If the dealer hands over money and doesn't receive the drugs, my non-expert understanding is that they can't then sue the government for fraud, presumably because of qualified or sovereign immunity. The reason the government won't give back the money is that it will initially be evidence, and then subject to civil asset forfeiture. I don't believe that it matters that the item being bought was illegal, as if property law doesn't apply to illegal goods, since, in theory, if one drug dealer stole drugs from another drug dealer, the government could prosecute the perpetrator for both the theft and the possession of the drugs.
  - Judgmentality 5y ago
    If it were ever presented in front of a judge it would be considered fraud. The FBI and CIA will go to extraordinary lengths to never actually have to face a judge, because they know what they are doing is illegal and their entire defense is obfuscation of the law. Even the police are doing this today to avoid ever having to face scrutiny over their use of STINGRAY devices. And when it does find its way in front of a judge, the judge gives them the proverbial "fuck you" https://arstechnica.com/tech-policy/2018/07/judge-slams-fbi-for-improper-cellphone-search-stingray-use/ https://arstechnica.com/tech-policy/2018/07/judge-slams-fbi-... People have this notion that the court system just blindly agrees with three lettered agencies, when in reality they tend to hate each other.
Avamander 5y ago
> They control the UI that shows you the certificates too. The Android system one that comes from the OEM? Or have they compromised the Java installation I have? The latter being very difficult for Google alone to make output incorrect results.
rocqua 5y ago
> They control the UI that shows you the certificates too. Really? They wrote the code for a part of it, sure. But that code was compiled by my OEM, and modified to put the OEM's extra little bit of sauce on there. Besides, the certificates aren't shown to me. They are used by the OS itself to verify updates to the app. Currently, signing gives control between a trusted developer of an app and any updates reaching my phone. This is enforced at the OS level. That means that the app store cannot just ship my phone false updates. At least, unless they can exploit the currently installed OS.

Judgmentality 5y ago

> They control the UI that shows you the certificates too. Sure, but if they lied about that isn't it an open-and-shut case of fraud? What they're doing here instead is obfuscating away everything behind an announcement, so there is no legal recourse for the consumer against their bullshit. The best we can do is hope an anti-trust suit is brought against Google (I have approximately zero hope of it happening because of this, though).

matthewowen 5y ago
You’re in a thread that starts with the premise that this is a vehicle that the fbi/cia are going to use to distribute backfired versions of apps like signal, in which case no, it’s not an open and shut case of fraud.
- dane-pgp 5y ago
  That's actually a good point. If the US government issues a National Security Letter or uses the All Writs Act to force Google to distribute a backdoored version of an app to a target of a criminal investigation, then it might be an open and shut case of compelled speech (challenged under the First Amendment, assuming the target had standing), but it's not obvious that actions done by a private company to fulfil a legal obligation from the government can ever be prosecuted as fraud. It might be helpful to consider a simpler situation, where an FBI agent pretends to have a shipment of drugs which a drug dealer attempts to buy. If the dealer hands over money and doesn't receive the drugs, my non-expert understanding is that they can't then sue the government for fraud, presumably because of qualified or sovereign immunity. The reason the government won't give back the money is that it will initially be evidence, and then subject to civil asset forfeiture. I don't believe that it matters that the item being bought was illegal, as if property law doesn't apply to illegal goods, since, in theory, if one drug dealer stole drugs from another drug dealer, the government could prosecute the perpetrator for both the theft and the possession of the drugs.
- Judgmentality 5y ago
  If it were ever presented in front of a judge it would be considered fraud. The FBI and CIA will go to extraordinary lengths to never actually have to face a judge, because they know what they are doing is illegal and their entire defense is obfuscation of the law. Even the police are doing this today to avoid ever having to face scrutiny over their use of STINGRAY devices. And when it does find its way in front of a judge, the judge gives them the proverbial "fuck you" https://arstechnica.com/tech-policy/2018/07/judge-slams-fbi-for-improper-cellphone-search-stingray-use/ https://arstechnica.com/tech-policy/2018/07/judge-slams-fbi-... People have this notion that the court system just blindly agrees with three lettered agencies, when in reality they tend to hate each other.

Avamander 5y ago

> They control the UI that shows you the certificates too. The Android system one that comes from the OEM? Or have they compromised the Java installation I have? The latter being very difficult for Google alone to make output incorrect results.

rocqua 5y ago

> They control the UI that shows you the certificates too. Really? They wrote the code for a part of it, sure. But that code was compiled by my OEM, and modified to put the OEM's extra little bit of sauce on there. Besides, the certificates aren't shown to me. They are used by the OS itself to verify updates to the app. Currently, signing gives control between a trusted developer of an app and any updates reaching my phone. This is enforced at the OS level. That means that the app store cannot just ship my phone false updates. At least, unless they can exploit the currently installed OS.