4 ms·

> "The other issue is that developers will need to give Google their app signing key to export an AAB app as an APK. This gives Google quite a bit of power." I

> "The other issue is that developers will need to give Google their app signing key to export an AAB app as an APK. This gives Google quite a bit of power." I can't even.

laweijfmvo 5y ago
I'm confused; why do developers need Google to export an APK for them? Can they no longer generate APKs (locally) themselves and distribute them however they like?
- zucker42 5y ago
  Based on the blog post's FAQ my impression is you can still do that. My impression is it's only for apps in the play store (and the corresponding export play store AAB to APK feature) that you are required to giving your keys to Google. https://android-developers.googleblog.com/2021/06/the-future-of-android-app-bundles-is.html?m=1 https://android-developers.googleblog.com/2021/06/the-future...
  - tadfisher 5y ago
    That is to allow existing apps to update to AAB distribution. New apps do not get access to the signing key, only the certificate.
meesterdude 5y ago
when i saw the headline, I knew google would use it as a pretext to do something disgusting. Everything they do has some dark pattern to it somewhere. AMP is a great example. You should never, ever give your signing key to anyone. Especially not google. you might think of google "they wouldn't" but in fact they can, they have, and they will again.
- tadfisher 5y ago
  Note that new apps don't provide the Play Store with the key, they just verify against the first certificate they receive.
  - bhawks 5y ago
    Not the point. This turns the trust model of the ecosystem on its head. When I install an app like Signal today - I have cryptographic certainty that it was the code the Signal team intended me to have with 0 tampering. In the new model - I have to trust that Google, it's employees and processes have not been subverted by another actor. It is a fundamentally weaker model. I hope Google budgeted some legal time responding to government court orders to spin custom targeted versions of apps for persons of interest. It might also be a tempting honeypot to identify employees that have been compromised by nation-state actors. It would be interesting to hear what things would have looked like if changing the trust model was off the table. Surely it must have had at least some discussion.
    - MrDresden 5y ago
      While I completely agree with what you say, I feel it must be pointed out that in the use case of using the bundled Play store application on the device, you have no way of being certain that it is delivering you the correct APK. It might just as well pull a modified version (there are caveats such as that the device can't already have a valid version of the application setup for this to go unnoticed). Pulling the apk from Play using something like Raccoon would allow you to verify the signature.
- whoknowswhat11 5y ago
  No one cares about your signing key. Google can create a key on their own servers if you want (you can't export this key so can't use it to sign apps for multiple stores) but u can keep your own keys secret
  - Avamander 5y ago
    You're cleverly ignoring the main use of signing, knowing the app wasn't tampered with before installation. You're also incorrect, if people have apps signed with your signing key then you must provide it to Google.
pavon 5y ago
This is insane. What is the point of even having a developer signing key if people other than the developer have access to it? Why don't they just sign the APKs with Google's own keys from here on out? Can't wait to hear Moxie's response on this. One of his (many) reasons for refusing to support FDroid was because it didn't allow developers to sign their own apps, and thus users had to trust that FDroid did not modify the app. Now FDroid has addressed that, but Google has not only removed that feature, but is demanding that developers allow Google to impersonate them.
- birksherty 5y ago
  > Now FDroid has addressed that Out of loop, what changed?
  - piaste 5y ago
    > Out of loop, what changed? https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
- resoluteteeth 5y ago
  Iirc they're switching to that model (google uses it's own key) but they need the developers' keys for older apps because android won't allow changing the key when an already installed app is upgraded.
  - pavon 5y ago
    Except Google maintains the code that performs those checks. Rolling out changes to key checking will result in a longer transition, but it is more legitimate than demanding developers hand over private signing keys. And in the meanwhile Google Play store knows which phones have been updated, so it can provided the slimmed-down Google-signed APKs to them, and the universal developer-signed APKs to everyone else.

> "The other issue is that developers will need to give Google their app signing key to export an AAB app as an APK. This gives Google quite a bit of power." I can't even.

laweijfmvo 5y ago

I'm confused; why do developers need Google to export an APK for them? Can they no longer generate APKs (locally) themselves and distribute them however they like?

zucker42 5y ago
Based on the blog post's FAQ my impression is you can still do that. My impression is it's only for apps in the play store (and the corresponding export play store AAB to APK feature) that you are required to giving your keys to Google. https://android-developers.googleblog.com/2021/06/the-future-of-android-app-bundles-is.html?m=1 https://android-developers.googleblog.com/2021/06/the-future...
- tadfisher 5y ago
  That is to allow existing apps to update to AAB distribution. New apps do not get access to the signing key, only the certificate.

meesterdude 5y ago

when i saw the headline, I knew google would use it as a pretext to do something disgusting. Everything they do has some dark pattern to it somewhere. AMP is a great example. You should never, ever give your signing key to anyone. Especially not google. you might think of google "they wouldn't" but in fact they can, they have, and they will again.

tadfisher 5y ago
Note that new apps don't provide the Play Store with the key, they just verify against the first certificate they receive.
- bhawks 5y ago
  Not the point. This turns the trust model of the ecosystem on its head. When I install an app like Signal today - I have cryptographic certainty that it was the code the Signal team intended me to have with 0 tampering. In the new model - I have to trust that Google, it's employees and processes have not been subverted by another actor. It is a fundamentally weaker model. I hope Google budgeted some legal time responding to government court orders to spin custom targeted versions of apps for persons of interest. It might also be a tempting honeypot to identify employees that have been compromised by nation-state actors. It would be interesting to hear what things would have looked like if changing the trust model was off the table. Surely it must have had at least some discussion.
  - MrDresden 5y ago
    While I completely agree with what you say, I feel it must be pointed out that in the use case of using the bundled Play store application on the device, you have no way of being certain that it is delivering you the correct APK. It might just as well pull a modified version (there are caveats such as that the device can't already have a valid version of the application setup for this to go unnoticed). Pulling the apk from Play using something like Raccoon would allow you to verify the signature.
whoknowswhat11 5y ago
No one cares about your signing key. Google can create a key on their own servers if you want (you can't export this key so can't use it to sign apps for multiple stores) but u can keep your own keys secret
- Avamander 5y ago
  You're cleverly ignoring the main use of signing, knowing the app wasn't tampered with before installation. You're also incorrect, if people have apps signed with your signing key then you must provide it to Google.

pavon 5y ago

This is insane. What is the point of even having a developer signing key if people other than the developer have access to it? Why don't they just sign the APKs with Google's own keys from here on out? Can't wait to hear Moxie's response on this. One of his (many) reasons for refusing to support FDroid was because it didn't allow developers to sign their own apps, and thus users had to trust that FDroid did not modify the app. Now FDroid has addressed that, but Google has not only removed that feature, but is demanding that developers allow Google to impersonate them.

birksherty 5y ago
> Now FDroid has addressed that Out of loop, what changed?
- piaste 5y ago
  > Out of loop, what changed? https://f-droid.org/en/docs/Reproducible_Builds/ https://f-droid.org/en/docs/Reproducible_Builds/
resoluteteeth 5y ago
Iirc they're switching to that model (google uses it's own key) but they need the developers' keys for older apps because android won't allow changing the key when an already installed app is upgraded.
- pavon 5y ago
  Except Google maintains the code that performs those checks. Rolling out changes to key checking will result in a longer transition, but it is more legitimate than demanding developers hand over private signing keys. And in the meanwhile Google Play store knows which phones have been updated, so it can provided the slimmed-down Google-signed APKs to them, and the universal developer-signed APKs to everyone else.