17 ms·
> Google uses comforting language to portray this as a very convenient feature for 'most' developers. However, this would also give Google an ability to ship mo
by csunbird 5y ago
> Google uses comforting language to portray this as a very convenient feature for 'most' developers. However, this would also give Google an ability to ship modified apps to users, still signed by perfectly valid App key, and this perspective looks really scary to me.
Interestingly, this also allows hostile takeovers of applications by state supported attackers, as you are no longer able to trust if the APK is signed by the original developer or not.
- MrDresden 5y agoAn honest question; Due to the way developer keys are derivative from a root certificate in Apple's ecosystem, hasn't this been a possibility there as well since the beginning of the appstore? I agree that this possibility exists, and personally wished it wasn't.
- csunbird 5y agoI am not familiar with Apple's app signing procedures, but from what you have said, it sounds like you create your own certificate and Apple cross signs your code bundle. In that case, Apple can not start publishing their own version but they can only remove their "blessing" by not signing your code anymore. Please correct me if I am wrong with this assumption.
- saurik 5y agoYou can change your developer certificate at any time though by getting a new one from Apple; so even if your signature is still in the resulting distribution somewhere (which I don't think it could be, but I mostly deal in creating forged signatures instead of parsing existing ones), it wouldn't have the end-to-end security properties Android has (well, "had" :/).
- csunbird 5y agoThat is very disappointing. Having a verified publisher signature is a good security measure, but Apple seem to not believe that.