4 ms·

Sure, there are any number of ways Microsoft could break their own security model. For example, they could stop verifying signatures entirely. The fact that the

Sure, there are any number of ways Microsoft could break their own security model. For example, they could stop verifying signatures entirely. The fact that they're not doing worse things doesn't make what they are doing less bad. If the problem is that app developers don't want to fix dependencies on Google services, but Amazon has a tool to fix them automatically, why can't they just release the tool and let developers sign the output themselves? Sure, some devs might be too lazy to do it, but how does that justify forcing everyone to give up control over their signatures?

cptskippy 5y ago
> If the problem is that app developers don't want to fix dependencies on Google services, but Amazon has a tool to fix them automatically, why can't they just release the tool and let developers sign the output themselves? I would imagine the tool rebinds the Google APIs to Amazon's equivalent APIs rather than neutering them. Since Apps are relying on the API responses. I don't imagine Amazon wants Apps distributed outside their Store using their APIs and getting a free ride. Am I missunderstanding things? Isn't the purpose of App Signing primarily for Google's software running on your device to verify Apps running in your device against public signatures Google holds on it's servers? I understand there's a chain of custody and a developer can upload their App, then download it from the store and be confident it's what they uploaded. But Google now allows you to put your signing keys into their KeyStore on their servers. I guess you still have a copy and can verify an App is signed with your Key but since you didn't do the signing that isn't enough to ensure it was signed without modification.
- teraflop 5y ago
  > But Google now allows you to put your signing keys into their KeyStore on their servers. I guess you still have a copy and can verify an App is signed with your Key but since you didn't do the signing that isn't enough to ensure it was signed without modification. In fact, Google is planning to soon force app developers to use this model, just like Amazon. Yes, it removes the ability for developers to know/control what code is running with their name attached to it, and it's bad regardless of who's doing it.
- iggldiggl 5y ago
  > Isn't the purpose of App Signing primarily for Google's software running on your device to verify Apps running in your device against public signatures Google holds on it's servers? The primary (or at least original) purpose is to verify that app updates (or in some cases extensions/companion app that can directly access each other's data) are signed by the same key as the already installed app. Though I supposed that these days PlayProtect will likely indeed check the signature against Google's database on first installation, too.
slownews45 5y ago
Huh - the signatures are for the store and store client to verify things. And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys.
- teraflop 5y ago
  > And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. As I said in another comment, it's not any better when Google is doing it instead of Amazon. > I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys. If we're being literal, they're not forcing you to give up your keys. They're forcing you to give up control over what code gets signed as part of your application -- that is, control over which signatures are considered valid. The end user has no way to verify that the application is what you released; they can only verify that it's what Amazon (or Google) decided to distribute on your behalf. Imagine if GitHub decided to take every repository with signed commits and rewrite it so that the code was signed by GitHub, instead of by the original authors. Why would anyone have a reason to trust those signatures?
  - slownews45 5y ago
    The issue is users trust google / amazon / github and their signatures MUCH MORE than they do random joe blow developers signatures. Let me explain something clearly - most users are NOT checking developers signatures. The clients, their trust is in the google / amazon's of the world. What google and amazon are saying, and what users care about, is that this application went through whatever process google / amazon have to describe / disclose the developer and their details, whatever scans google / amazon do, whatever CDN distribution they use has not messed with things, whatever govt agencies / firewalls are between users and google / amazon have not messed with things etc etc. Google already has access to users systems - if they want to root android they can (in most cases google play services has root already). Many users are more worried about bad behavior by apps on their system (and there is plenty of history of that behavior). This also let's amazon / google etc re-target apps themselves. They can link to shim libraries to run on other platforms etc etc. The value there is high. Many developers aren't going to sort that type of stuff out. This same model applies in open source. When Redhat / Fedora upgrade something, they can recompile their entire RHEL if they want to to target / work with whatever upgrade they've pushed. Again, users on redhat don't care about the developers signatures, they care about redhats. Of course, on HN the outrage is going to be at Google, but most open source distros work exactly this way as well.

cptskippy 5y ago

> If the problem is that app developers don't want to fix dependencies on Google services, but Amazon has a tool to fix them automatically, why can't they just release the tool and let developers sign the output themselves? I would imagine the tool rebinds the Google APIs to Amazon's equivalent APIs rather than neutering them. Since Apps are relying on the API responses. I don't imagine Amazon wants Apps distributed outside their Store using their APIs and getting a free ride. Am I missunderstanding things? Isn't the purpose of App Signing primarily for Google's software running on your device to verify Apps running in your device against public signatures Google holds on it's servers? I understand there's a chain of custody and a developer can upload their App, then download it from the store and be confident it's what they uploaded. But Google now allows you to put your signing keys into their KeyStore on their servers. I guess you still have a copy and can verify an App is signed with your Key but since you didn't do the signing that isn't enough to ensure it was signed without modification.

teraflop 5y ago
> But Google now allows you to put your signing keys into their KeyStore on their servers. I guess you still have a copy and can verify an App is signed with your Key but since you didn't do the signing that isn't enough to ensure it was signed without modification. In fact, Google is planning to soon force app developers to use this model, just like Amazon. Yes, it removes the ability for developers to know/control what code is running with their name attached to it, and it's bad regardless of who's doing it.
iggldiggl 5y ago
> Isn't the purpose of App Signing primarily for Google's software running on your device to verify Apps running in your device against public signatures Google holds on it's servers? The primary (or at least original) purpose is to verify that app updates (or in some cases extensions/companion app that can directly access each other's data) are signed by the same key as the already installed app. Though I supposed that these days PlayProtect will likely indeed check the signature against Google's database on first installation, too.

slownews45 5y ago

Huh - the signatures are for the store and store client to verify things. And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys.

teraflop 5y ago
> And if you are going to use Android App Bundles or whatever google is recommending, you'll be using Play App Signing. As I said in another comment, it's not any better when Google is doing it instead of Amazon. > I guess I'm just curious what "keys" amazon is forcing you to give up. I'm not sure they even care about your keys. If we're being literal, they're not forcing you to give up your keys. They're forcing you to give up control over what code gets signed as part of your application -- that is, control over which signatures are considered valid. The end user has no way to verify that the application is what you released; they can only verify that it's what Amazon (or Google) decided to distribute on your behalf. Imagine if GitHub decided to take every repository with signed commits and rewrite it so that the code was signed by GitHub, instead of by the original authors. Why would anyone have a reason to trust those signatures?
- slownews45 5y ago
  The issue is users trust google / amazon / github and their signatures MUCH MORE than they do random joe blow developers signatures. Let me explain something clearly - most users are NOT checking developers signatures. The clients, their trust is in the google / amazon's of the world. What google and amazon are saying, and what users care about, is that this application went through whatever process google / amazon have to describe / disclose the developer and their details, whatever scans google / amazon do, whatever CDN distribution they use has not messed with things, whatever govt agencies / firewalls are between users and google / amazon have not messed with things etc etc. Google already has access to users systems - if they want to root android they can (in most cases google play services has root already). Many users are more worried about bad behavior by apps on their system (and there is plenty of history of that behavior). This also let's amazon / google etc re-target apps themselves. They can link to shim libraries to run on other platforms etc etc. The value there is high. Many developers aren't going to sort that type of stuff out. This same model applies in open source. When Redhat / Fedora upgrade something, they can recompile their entire RHEL if they want to to target / work with whatever upgrade they've pushed. Again, users on redhat don't care about the developers signatures, they care about redhats. Of course, on HN the outrage is going to be at Google, but most open source distros work exactly this way as well.