4 ms·

“ A government could compel the app store owner to change your app, too.”

josefx 5y ago
I am not sure it is any way better right now. Is there even a way a user can check who signed the apk unless he has his unlocked android device hooked up to a PC with android dev. tools installed and a black belt in android development?
- roody15 5y ago
  APK model has worked well… does it need changed?
  - techrat 5y ago
    It's not being changed. The end format is still APK.
    - roody15 5y ago
      Except google gets the source code first and then creates custom specific APK’s. Not sure this step is really “needed”.
      - tdeck 5y ago
        nit: Google doesn't get the source code. It gets essentially the contents of the APK (compiled DEX code, compiled native code, assets, and resources) along with some additional protobuf files that contain metadata. Google can then decide how to split that up into APKs, generate those, and sign them. In theory Google could add or alter things before signing them. The alternative to this was called Multi-APK and hardly anyone used it. It required generating and uploading a large number of different APKs and then uploading gigabytes of mostly-redundant APKs to the Play Store. That allowed you to manage the signing and minimize install size, but it was such a pain to orchestrate that it wasn't practical in most cases.
    - Avamander 5y ago
      That's a very narrow technical view of the thing. It's pretty much only a .zip after AAB. You're losing universality, signature checks, tamper-resistance which made apks apks.
  - Andrex 5y ago
    From Google's perspective, it increases flexibility and the overall installation process for Google Play, and probably (speculating) cuts down on costs over the long-term. From the broader perspective of the Android ecosystem, it's debatably monopolistic behavior. Google's defense by showing alternative app stores on Android gets slightly weaker.
- SXX 5y ago
  AFAIK you can't easily check keys, but current behavior is still much better: 1. Android only allow you to update existing apps with APK signed by the same key. Google can't just push you update that gonna steal app data. 2. After you installed an app through Google Play you can safely update it from different APK source and know that it signed by correct developer. This is helpful when app you being using through Google Play blocked in your country or something.
  - redxdev 5y ago
    Re: 1 - Sure they can. The play store has the ability to both uninstall and install apps without direct user input. Even if the OS itself blocks updating an app with a different key, it doesn't block uninstalling and then reinstalling with a different key to my knowledge. AABs are hardly required for Google to inject their own code into apps. And honestly, why would you even be concerned about them injecting code into third party apps? If they really wanted to be malicious they could use system apps that they fully control anyway. I do have concerns with Google removing the ability for developers to sign apps but Google themselves acting maliciously isn't why.
    - Avamander 5y ago
      > Re: 1 - Sure they can. Sure they can't. Data is lost. > AABs are hardly required for Google to inject their own code into apps. Much harder for Google (or anyone legally mandating them) to get caught with AABs though. > And honestly, why would you even be concerned about them injecting code into third party apps? ... in addition to a bunch of security issues. Also makes it possible to do forced monetization, like YouTube has done.
      - UncleMeat 5y ago
        > Sure they can't. Data is lost. So? Presumably you are going to continue to interact with the app. > .. in addition to a bunch of security issues. What security issues? > Also makes it possible to do forced monetization, like YouTube has done. Forced monetization is an even stupider conspiracy than NSA spying since it would require wide use rather than targeted changes. This would be plainly obvious since there are loads of people who decompile apps and the signature on the code section would be broken.
- sigmar 5y ago
  >Is there even a way a user can check who signed the apk Yes, super easy to check all the signatures on every app in your android phone with this: https://f-droid.org/en/packages/info.guardianproject.checkey/ https://f-droid.org/en/packages/info.guardianproject.checkey...
UncleMeat 5y ago
Signatures are only checked for consistency on updates. From a technical perspective, this was always possible for first installs. If you are concerned about Google being malicious, don't use Android. This entire discussion is just bizarre.

I am not sure it is any way better right now. Is there even a way a user can check who signed the apk unless he has his unlocked android device hooked up to a PC with android dev. tools installed and a black belt in android development?

roody15 5y ago
APK model has worked well… does it need changed?
- techrat 5y ago
  It's not being changed. The end format is still APK.
  - roody15 5y ago
    Except google gets the source code first and then creates custom specific APK’s. Not sure this step is really “needed”.
    - tdeck 5y ago
      nit: Google doesn't get the source code. It gets essentially the contents of the APK (compiled DEX code, compiled native code, assets, and resources) along with some additional protobuf files that contain metadata. Google can then decide how to split that up into APKs, generate those, and sign them. In theory Google could add or alter things before signing them. The alternative to this was called Multi-APK and hardly anyone used it. It required generating and uploading a large number of different APKs and then uploading gigabytes of mostly-redundant APKs to the Play Store. That allowed you to manage the signing and minimize install size, but it was such a pain to orchestrate that it wasn't practical in most cases.
  - Avamander 5y ago
    That's a very narrow technical view of the thing. It's pretty much only a .zip after AAB. You're losing universality, signature checks, tamper-resistance which made apks apks.
- Andrex 5y ago
  From Google's perspective, it increases flexibility and the overall installation process for Google Play, and probably (speculating) cuts down on costs over the long-term. From the broader perspective of the Android ecosystem, it's debatably monopolistic behavior. Google's defense by showing alternative app stores on Android gets slightly weaker.
SXX 5y ago
AFAIK you can't easily check keys, but current behavior is still much better: 1. Android only allow you to update existing apps with APK signed by the same key. Google can't just push you update that gonna steal app data. 2. After you installed an app through Google Play you can safely update it from different APK source and know that it signed by correct developer. This is helpful when app you being using through Google Play blocked in your country or something.
- redxdev 5y ago
  Re: 1 - Sure they can. The play store has the ability to both uninstall and install apps without direct user input. Even if the OS itself blocks updating an app with a different key, it doesn't block uninstalling and then reinstalling with a different key to my knowledge. AABs are hardly required for Google to inject their own code into apps. And honestly, why would you even be concerned about them injecting code into third party apps? If they really wanted to be malicious they could use system apps that they fully control anyway. I do have concerns with Google removing the ability for developers to sign apps but Google themselves acting maliciously isn't why.
  - Avamander 5y ago
    > Re: 1 - Sure they can. Sure they can't. Data is lost. > AABs are hardly required for Google to inject their own code into apps. Much harder for Google (or anyone legally mandating them) to get caught with AABs though. > And honestly, why would you even be concerned about them injecting code into third party apps? ... in addition to a bunch of security issues. Also makes it possible to do forced monetization, like YouTube has done.
    - UncleMeat 5y ago
      > Sure they can't. Data is lost. So? Presumably you are going to continue to interact with the app. > .. in addition to a bunch of security issues. What security issues? > Also makes it possible to do forced monetization, like YouTube has done. Forced monetization is an even stupider conspiracy than NSA spying since it would require wide use rather than targeted changes. This would be plainly obvious since there are loads of people who decompile apps and the signature on the code section would be broken.
sigmar 5y ago
>Is there even a way a user can check who signed the apk Yes, super easy to check all the signatures on every app in your android phone with this: https://f-droid.org/en/packages/info.guardianproject.checkey/ https://f-droid.org/en/packages/info.guardianproject.checkey...

UncleMeat 5y ago

Signatures are only checked for consistency on updates. From a technical perspective, this was always possible for first installs. If you are concerned about Google being malicious, don't use Android. This entire discussion is just bizarre.