4 ms·
With google play store, an _update_ to an app needs to be signed with the same keys as the original app. Hence, google play store cannot just give my an update
by rocqua 5y ago
With google play store, an _update_ to an app needs to be signed with the same keys as the original app.
Hence, google play store cannot just give my an updated backdoored version of signal or whatsapp unless they can get those developers to sign it. With this new system google could unilaterally decide to push such an update. Either to everyone, or just to a few select people.
> Who signs what doesn’t change the threat models.
It very VERY much does. He who signs is he who is able to modify code. If it did not, what value do signatures even have?
It seems you are arguing that, since google already controls android, they already control this data anyway. Thing is, the OS on my phone is already on there. Updates need to go through the manufacturer, and are hard to target. The play-store itself cannot read my signal messages.
Hence, for google to read my signal messages, right now, they would need to have a pre-existing backdoor in android, or run an exploit through the play-store.
With the new system, they could just push an update to my signal app. (If signal were to use the new system).
That, in my opinion, warrants changing the threat model quite a bit.
- capableweb 5y ago> With google play store, an _update_ to an app needs to be signed with the same keys as the original app. Sure, just like how if you let's say own Google Play Store and own those updating keys, you can change it (selectively most likely) to skip checking the signed updates. They own the full pipeline so if they want, you really stand no chance unless you're running your own OS.
- twobitshifter 5y agoThis happens on the OS level not play store.You can see it yourself if you try to install a release version over a debug version on your phone.
- rocqua 5y ago> Sure, just like how if you let's say own Google Play Store and own those updating keys The ENTIRE POINT, of this scare is that currently, google does not have access to those keys, developers do. And the signatures on these apps are checked by the OS, not the play store. Notably, google can't change the OS on my phone at their whim. They'd need to release a new version and get Samsung (and maybe my carrier) to ship that OS to me.
- m-p-3 5y agoEven outside of the Play Store, an APK cannot be updated by another one using a different signature. It's a verification made by the OS itself. F-Droid themselves compile and signs the binaries offered by their repository, which everyone seems to be fine with. I believe they're also working towards reproducible builds to let others independently verify the compilation matches the source code.