3 ms·

Android has done it for me every time I install an update to an app.

by rocqua 5y ago

UncleMeat 5y ago
Have you checked? Because people here are claiming that Google is an adversary in their threat models. So you can't just assume that the OS actually did verify the signing key. Or perhaps it makes more sense to not consider the developer of your operating system to be adversarial.
- lol768 5y ago
  > Have you checked? Yes, I've stripped, patched and re-signed apps and verified that installing them as an update failed. For various reasons I think it's reasonable to assume it's more difficult to be running a phone with a compromised OS (particularly given the bootloader is unlockable and you can install a 100% OSS ROM) than to assume the Play store is not serving something malicious.
- rocqua 5y ago
  Google is not some monolithic entity. And my android install is not under direct control by google (barring some back-door they installed). If google wants to change my android OS, they need to go through the play-store, or through Samsung to push an update. Those are difficult things to do. The play-store should still be bound by the OS, as it is simply an application. And going through samsung to deliver me a targeted update seems quite difficult and involves another party. Besides, the worry is not "Google Evil". The worry is "Google might be coerced into compromising a specific user". For that usecase, presuming google is _not_ evil and has not backdoored pre-existing android installs, signed updates to apps actually help a lot. As a matter of legal theory, forcing google to backdoor android / the play-store is so much harder than forcing google to just sign this one update of an app. This is not about "protecting ourselves from Google". This is about making it as hard as possible for google to do bad things, so it is harder for outsiders to influence Google. I think that, for the argument you are making, the play-store is the strongest point. I am unsure of how deep the privileges of the play-store run, but it has more control than most apps, and is easily google controlled. I suspect that google would still need to run an exploit against android OS to actually get e.g. my signal messages.
  - UncleMeat 5y ago
    > barring some back-door they installed But that is the whole point. People are apparently concerned about a backdoor using one channel and not in another, which makes little sense. Either you trust Google or you don't. "It would be a little trickier to ship a bad OS version / WebView implementation / GMS implementation" isn't an especially meaningful approach. > As a matter of legal theory, forcing google to backdoor android / the play-store is so much harder than forcing google to just sign this one update of an app. I don't believe there is any evidence for this. > I suspect that google would still need to run an exploit against android OS to actually get e.g. my signal messages. If you are specifically worried about Signal then this change does not affect you because this is only a requirement for new apps. This is one reason why I find the argument that this is all a backdoor for the NSA so ridiculous. People seem to be claiming that the NSA has the strength to strongarm Google to implement a feature like this and roll it out for years (App Bundles have been around for a long time as an option) and is willing to wait for basically the entire market to turnover so that privacy-critical apps are all using this feature but can't force a change at the OS level that works universally.

Android has done it for me every time I install an update to an app.

by rocqua 5y ago

Android has done it for me every time I install an update to an app.

Have you checked? Because people here are claiming that Google is an adversary in their threat models. So you can't just assume that the OS actually did verify the signing key. Or perhaps it makes more sense to not consider the developer of your operating system to be adversarial.

lol768 5y ago
> Have you checked? Yes, I've stripped, patched and re-signed apps and verified that installing them as an update failed. For various reasons I think it's reasonable to assume it's more difficult to be running a phone with a compromised OS (particularly given the bootloader is unlockable and you can install a 100% OSS ROM) than to assume the Play store is not serving something malicious.
rocqua 5y ago
Google is not some monolithic entity. And my android install is not under direct control by google (barring some back-door they installed). If google wants to change my android OS, they need to go through the play-store, or through Samsung to push an update. Those are difficult things to do. The play-store should still be bound by the OS, as it is simply an application. And going through samsung to deliver me a targeted update seems quite difficult and involves another party. Besides, the worry is not "Google Evil". The worry is "Google might be coerced into compromising a specific user". For that usecase, presuming google is _not_ evil and has not backdoored pre-existing android installs, signed updates to apps actually help a lot. As a matter of legal theory, forcing google to backdoor android / the play-store is so much harder than forcing google to just sign this one update of an app. This is not about "protecting ourselves from Google". This is about making it as hard as possible for google to do bad things, so it is harder for outsiders to influence Google. I think that, for the argument you are making, the play-store is the strongest point. I am unsure of how deep the privileges of the play-store run, but it has more control than most apps, and is easily google controlled. I suspect that google would still need to run an exploit against android OS to actually get e.g. my signal messages.
- UncleMeat 5y ago
  > barring some back-door they installed But that is the whole point. People are apparently concerned about a backdoor using one channel and not in another, which makes little sense. Either you trust Google or you don't. "It would be a little trickier to ship a bad OS version / WebView implementation / GMS implementation" isn't an especially meaningful approach. > As a matter of legal theory, forcing google to backdoor android / the play-store is so much harder than forcing google to just sign this one update of an app. I don't believe there is any evidence for this. > I suspect that google would still need to run an exploit against android OS to actually get e.g. my signal messages. If you are specifically worried about Signal then this change does not affect you because this is only a requirement for new apps. This is one reason why I find the argument that this is all a backdoor for the NSA so ridiculous. People seem to be claiming that the NSA has the strength to strongarm Google to implement a feature like this and roll it out for years (App Bundles have been around for a long time as an option) and is willing to wait for basically the entire market to turnover so that privacy-critical apps are all using this feature but can't force a change at the OS level that works universally.