12 ms·

S.Korea fines Google $177M for blocking Android customisation

267 points by quasisphere 5y ago

ggktk 5y ago
I recently installed LineageOS on my phone, replacing the stock MIUI. I would probably return this phone if I had no other option than to use MIUI. I much prefer the "pure" Android experience. For many essential and security critical apps to work, like bank apps or the McDonald's app you need to hide the fact you're using a modified system, because of SafetyNet. This hiding/bypass works for now, because it tricks Google into thinking your device doesn't support hardware attestation, and fallbacking to Basic attestation, which is easier to bypass. Google can at any time flip the switch to require hardware attestation, and your apps will stop working, with no way around it, other than flashing back the stock ROM your device came with and locking the bootloader. At that point I will probably just buy a new phone.
- NullPrefix 5y ago
  >or the McDonald's app Excuse me? McDonald's app considers itself security critical now?
  - jmnicolas 5y ago
    Probably because you can pay your meals with it.
  - HelixEndeavor 5y ago
    Anything that deals with your financial information usually has security.
  - deleted 5y ago
    [deleted]
  - marcellus23 5y ago
    I mean, you put your credit card into it, so yeah?
    - grishka 5y ago
      You also put your credit card into your web browser, and it can even store your cards (without the cvc) to autofill them for you.
      - kevingadd 5y ago
        Yes, and this is a massive security vulnerability
      - bee_rider 5y ago
        The web browser is almost certainly security critical -- although maybe it is treated as a special exception because of user expectations.
        grishka 5y ago
        Yes, but somehow, web browsers never check for "device integrity", and websites just blindly trust that the browser, or whatever it is on the other end, would do whatever it's told. They don't even have a reliable way of telling what kind of device or OS the user is accessing the website from. And everyone seems to be fine with that. And that's how it should be with apps, too. And people need to be educated to never, ever be so trustful. You lost your savings to a scammer? Well, you'll be more diligent next time.
- esperent 5y ago
  I bought a Miui phone about a week ago. It's on miui 12.5 and it's the first time I've ever used this OS. I expected to hate it because of all the flack it gets. But honestly, it's fine. It's not that different from Android. I did have to uninstall a load of bloatware using ADB and I added a custom launcher (Niagara).
  - izacus 5y ago
    MIUI is Android though - and it passes strict Google CTS tests so it stays (reasonably) compatible with software.
- izacus 5y ago
  Sure, but your LineageOS only works because Google is forcing manufacturers to pass CTS tests (which ensure that all Android devices are actually compatible with your apps). If that disappears, you'll end up with apps that only work on Samsung Androids and your LineageOS will stop being compatible. We're essentially going back to horrorshow of SymbianOS, where different Symbian devices weren't compatible between themselves because the OEMs kept fscking up. (Heck, in early Android versions Samsung tended to break core APIs all the time and caused a lot of churn on developer side to workaround their per-device fsckups. Having to import phones from half a world away so you could see why the video recorder hardcrashes when you call an API is NOT FUN.).
  - grishka 5y ago
    I remember how people were complaining loudly about my app crashing on Meizu phones. Those never passed the CTS, but that didn't stop the manufacturer from preinstalling play services on them. So we had to buy one and I had to decompile the system framework to find a way to work around their shitty modifications to standard UI components to prevent the app from crashing. Fun stuff.
  - deleted 5y ago
    [deleted]
- baybal2 5y ago
  At least one SafetyNet TZ applet has leaked few years ago
causi 5y ago
I hate when a law or legal decision is aimed 45 degrees off like this. Letting manufacturers bundle their fucked-up version of Android is a bad thing. What we need is mandatory unlockable bootloaders so the users can load whatever they want on their devices.
- gjsman-1000 5y ago
  There will still need to be the option for a locked boot loader though. If I’m Snowden, knowing my boot loader could be unlocked and a key logger side loaded isn’t reassuring.
  - causi 5y ago
    I'm not aware of any manufacturer who allows bootloader unlocking without also displaying a warning screen every time the phone boots up. Example: https://www.thecustomdroid.com/wp-content/uploads/2019/06/How-to-Unlock-Bootloader-on-OnePlus-7-and-OnePlus-7-Pro.jpg https://www.thecustomdroid.com/wp-content/uploads/2019/06/Ho...
    - piaste 5y ago
      My current phone (Xiaomi POCO F2 Pro) only displays a faint lock/unlock icon above the logo while booting. Easy to miss. But that's not really important, because unlocking the bootloader factory resets the device on every Android phone that I know of. AFAIK it's not possible to unlock a bootloader without the owner's knowledge.
      - causi 5y ago
        Even if it's easy to miss, a person like Snowden would be looking out for it.
  - 2Gkashmiri 5y ago
    If such snowden like person wants to use such a device, wouldn't he be able to change to lineage os or whatever knowing full well he is now the master of the device or is there malware that persists still ?
amelius 5y ago
Will they also fine Samsung for blocking the user's right to remove manufacturer-bundled cruftware?
- Sparkle-san 5y ago
  Given that Samsung's revenue is about 12% of S. Korea's GDP, I'm guessing that they will not.
  - rjzzleep 5y ago
    Given that the head of Samsung was in prison for bribery of the president(of korea) and then got released on parole for using Covid vaccination as currency I'm guessing that they DEFINITELY will not. https://www.bloombergquint.com/business/samsung-s-lee-receives-parole-after-jail-sentence-for-bribery https://www.bloombergquint.com/business/samsung-s-lee-receiv...
    - deleted 5y ago
      [deleted]
    - worrycue 5y ago
      2009 - https://www.reuters.com/article/us-korea-samsung-idUSTRE5BS07W20091229 https://www.reuters.com/article/us-korea-samsung-idUSTRE5BS0... Somethings never change.
ocdtrekkie 5y ago
It's incredible how long the AFA has been known about and how blatantly illegal it is, yet not subject to any significant penalties. Law moves so freaking slow, this is about a 2013 complaint. Dealing with tech industry crooks requires faster movement than this.
danschumann 5y ago
This seems like an issue similar to right to repair... let hackers(in the traditional sense) have their place.
- ocdtrekkie 5y ago
  It really isn't because the AFA doesn't impact hackers. It's about basically operating a cartel where a single company controls the products of a large number of other companies and illegally binds them for making their own business decisions. Google held/holds the ability to allow or disallow all product releases Android manufacturers release, including products which do not use Google Play Services. Tizen became critical to Samsung because Samsung couldn't release a smart fridge with Android in the background without Google's permission, even if they had no intent on it having a traditional app store... because it might constitute a fork of Android.
flerchin 5y ago
From what I can understand, AFA meant that a manufacturer could lose their license to Google Play Services on _all_ of their devices if they produced _any_ devices using an Android fork. This is a clear abuse of market power.
- deleted 5y ago
  [deleted]
ApolloFortyNine 5y ago
Meanwhile the only real android competitor is manufactured by one company who doesn't allow even the end user to install apps not directly approved by Apple.
- anaganisk 5y ago
  Do you really call iOS a competitor to android? Its like saying KIA is competitor to a Rolls Royce. Androids range from 50USD to anything else. Apple and Google makes phones but they’re not competitors, their market segments, user base have different opinions on what they want and do.
  - mdoms 5y ago
    Yes iOS is quite obviously a competitor to Android.
    - anaganisk 5y ago
      Not even in nearest terms, Android users mostly dont want to use iOS. Neither do most of the iOS users want to use Android. Like I said, they both are different kind of things of the same technology. Apple is no where near Android in world level in-terms of competition either. Like I said Kia is not a competitor to Rolls Royce.
      - ranguna 5y ago
        Kia is not a competitor to RR because there are loads of luxury car brands that compete with RR and loads of general-to-expensive brands that compete with Kia. In the smartphone OS market, it doesn't matter if apple is on the luxury spectrum and android is on the general spectrum, because they are the only relevant OSs around (excluding harmony because it doesn't have nearly as much market share as those two). So yes, android and iOS are competitors, unless other luxury OS pops up to compete with iOS or OSs like harmony become more relevant to compete with android. If Kia and RR were the only car brands, they'd be competitors of each other because there are "cheap" second hand cars by RR that compete with Kia (like second hand iPhones) and expensive Kia cars that compete with RR (expensive android phones that compete with apple ones).
baybal2 5y ago
Just for a note — JY Lee just cane out from behind the bars a few weeks ago.
pcr910303 5y ago
I think the throwback on HN on this decision is due to the lack of details and context on the news? From what I've understood from the local news (I'm a South Korean), It's not about blocking handsets with forked Android (that already happens regularly AFAIK), but the requirement of shipping Google apps like Chrome and Google Assistant. The big elephant in the room here is Samsung phones, which do ship it's own custom browser Samsung Internet (BTW, with ad blocking capabilities!) and a separate virtual assistant, Bixby. That's the part where the KFTC decided was monopolistic. I don't have a personal opinion this, but seems that the comment threads are focusing on the wrong part. Manufacturers were always able to bundle up their fucked-up version of Android. They were always able to ship super-custom UIs. Google never prevented that... but they did force the UIs bloat by having two separate default apps.
- lifthrasiir 5y ago
  Also, it should be noted that Google didn't just disallow shipping Google apps to forked Android. Google disallowed shipping Google apps to any devices from vendors that ship forked Android: if your smartwatch is using forked Android your ordinary smartphone also can't have Google apps even when it's using genuine Android. The KFTC made very clear that this is a nuclear all-or-nothing option to hardware vendors and thus constitutes an anti-trust action [1]. [1] https://ftc.go.kr/www/selectReportUserView.do?key=10&rpttype=1&report_data_no=9254 https://ftc.go.kr/www/selectReportUserView.do?key=10&rpttype... (in Korean)
  - fennecfoxy 5y ago
    Idk I can somewhat see their reasons. Forked Android isn't necessarily secure: a customer who owns the phone might get hacked or suffer some problem and who will they blame? Not Samsung or Xiaomi etc. They'll blame Google. If you're signed into Google etc on your phone and that is compromised, it appears to the average person that Google messed up.
- qutreM 5y ago
  > Samsung Internet (BTW, with ad blocking capabilities!) which browser doesn't come with that capability available?
forgotmypw17 5y ago
Who controls the OS controls the browser. Who controls the browser controls the platform. Nothing has changed since the mid-1990s.
slownews45 5y ago
The entire focus on anti-trust and moved to harm to other (big) businesses - no care about the consumer. The Anti-fragmentation agreement google makes these folks sign HELPS consumers. Going to be a crazy situation if that goes away, the app you buy on samsung won't work on HTC etc.
- eredengrin 5y ago
  If the oems get fragmented enough then it might open up more space for a smaller competitor (ie an open source project) to come fill the gaps, and I certainly wouldn't mind that. Of course it's not a guarantee but I could see it happening - the more dissatisfied the lazy tech nerd segment gets the more we would all band together and try and make the situation better, and also by the competitors becoming more fragmented it might open others up to possibilities they didn't consider previously. (And yes I am putting myself in lazy tech nerd segment at least as far as my phone goes, I've always run cyanogenmod in the past but the last phone I bought I spent a weekend trying to flash lineage and it was annoying enough of a process I ended up back on stock ROM....but I'd certainly be down to try again given the right circumstances.)
urthor 5y ago
The headline makes it look like this is for the benefit of consumers. The article makes it clear this ruling is entirely to the benefit of Samsung Electronics.

267 points by quasisphere 5y ago

I recently installed LineageOS on my phone, replacing the stock MIUI. I would probably return this phone if I had no other option than to use MIUI. I much prefer the "pure" Android experience. For many essential and security critical apps to work, like bank apps or the McDonald's app you need to hide the fact you're using a modified system, because of SafetyNet. This hiding/bypass works for now, because it tricks Google into thinking your device doesn't support hardware attestation, and fallbacking to Basic attestation, which is easier to bypass. Google can at any time flip the switch to require hardware attestation, and your apps will stop working, with no way around it, other than flashing back the stock ROM your device came with and locking the bootloader. At that point I will probably just buy a new phone.

NullPrefix 5y ago
>or the McDonald's app Excuse me? McDonald's app considers itself security critical now?
- jmnicolas 5y ago
  Probably because you can pay your meals with it.
- HelixEndeavor 5y ago
  Anything that deals with your financial information usually has security.
- deleted 5y ago
  [deleted]
- marcellus23 5y ago
  I mean, you put your credit card into it, so yeah?
  - grishka 5y ago
    You also put your credit card into your web browser, and it can even store your cards (without the cvc) to autofill them for you.
    - kevingadd 5y ago
      Yes, and this is a massive security vulnerability
    - bee_rider 5y ago
      The web browser is almost certainly security critical -- although maybe it is treated as a special exception because of user expectations.
      - grishka 5y ago
        Yes, but somehow, web browsers never check for "device integrity", and websites just blindly trust that the browser, or whatever it is on the other end, would do whatever it's told. They don't even have a reliable way of telling what kind of device or OS the user is accessing the website from. And everyone seems to be fine with that. And that's how it should be with apps, too. And people need to be educated to never, ever be so trustful. You lost your savings to a scammer? Well, you'll be more diligent next time.
esperent 5y ago
I bought a Miui phone about a week ago. It's on miui 12.5 and it's the first time I've ever used this OS. I expected to hate it because of all the flack it gets. But honestly, it's fine. It's not that different from Android. I did have to uninstall a load of bloatware using ADB and I added a custom launcher (Niagara).
- izacus 5y ago
  MIUI is Android though - and it passes strict Google CTS tests so it stays (reasonably) compatible with software.
izacus 5y ago
Sure, but your LineageOS only works because Google is forcing manufacturers to pass CTS tests (which ensure that all Android devices are actually compatible with your apps). If that disappears, you'll end up with apps that only work on Samsung Androids and your LineageOS will stop being compatible. We're essentially going back to horrorshow of SymbianOS, where different Symbian devices weren't compatible between themselves because the OEMs kept fscking up. (Heck, in early Android versions Samsung tended to break core APIs all the time and caused a lot of churn on developer side to workaround their per-device fsckups. Having to import phones from half a world away so you could see why the video recorder hardcrashes when you call an API is NOT FUN.).
- grishka 5y ago
  I remember how people were complaining loudly about my app crashing on Meizu phones. Those never passed the CTS, but that didn't stop the manufacturer from preinstalling play services on them. So we had to buy one and I had to decompile the system framework to find a way to work around their shitty modifications to standard UI components to prevent the app from crashing. Fun stuff.
- deleted 5y ago
  [deleted]
baybal2 5y ago
At least one SafetyNet TZ applet has leaked few years ago

causi 5y ago

I hate when a law or legal decision is aimed 45 degrees off like this. Letting manufacturers bundle their fucked-up version of Android is a bad thing. What we need is mandatory unlockable bootloaders so the users can load whatever they want on their devices.

gjsman-1000 5y ago
There will still need to be the option for a locked boot loader though. If I’m Snowden, knowing my boot loader could be unlocked and a key logger side loaded isn’t reassuring.
- causi 5y ago
  I'm not aware of any manufacturer who allows bootloader unlocking without also displaying a warning screen every time the phone boots up. Example: https://www.thecustomdroid.com/wp-content/uploads/2019/06/How-to-Unlock-Bootloader-on-OnePlus-7-and-OnePlus-7-Pro.jpg https://www.thecustomdroid.com/wp-content/uploads/2019/06/Ho...
  - piaste 5y ago
    My current phone (Xiaomi POCO F2 Pro) only displays a faint lock/unlock icon above the logo while booting. Easy to miss. But that's not really important, because unlocking the bootloader factory resets the device on every Android phone that I know of. AFAIK it's not possible to unlock a bootloader without the owner's knowledge.
    - causi 5y ago
      Even if it's easy to miss, a person like Snowden would be looking out for it.
- 2Gkashmiri 5y ago
  If such snowden like person wants to use such a device, wouldn't he be able to change to lineage os or whatever knowing full well he is now the master of the device or is there malware that persists still ?

amelius 5y ago

Will they also fine Samsung for blocking the user's right to remove manufacturer-bundled cruftware?

Sparkle-san 5y ago
Given that Samsung's revenue is about 12% of S. Korea's GDP, I'm guessing that they will not.
- rjzzleep 5y ago
  Given that the head of Samsung was in prison for bribery of the president(of korea) and then got released on parole for using Covid vaccination as currency I'm guessing that they DEFINITELY will not. https://www.bloombergquint.com/business/samsung-s-lee-receives-parole-after-jail-sentence-for-bribery https://www.bloombergquint.com/business/samsung-s-lee-receiv...
  - deleted 5y ago
    [deleted]
  - worrycue 5y ago
    2009 - https://www.reuters.com/article/us-korea-samsung-idUSTRE5BS07W20091229 https://www.reuters.com/article/us-korea-samsung-idUSTRE5BS0... Somethings never change.

ocdtrekkie 5y ago

It's incredible how long the AFA has been known about and how blatantly illegal it is, yet not subject to any significant penalties. Law moves so freaking slow, this is about a 2013 complaint. Dealing with tech industry crooks requires faster movement than this.

danschumann 5y ago

This seems like an issue similar to right to repair... let hackers(in the traditional sense) have their place.

ocdtrekkie 5y ago
It really isn't because the AFA doesn't impact hackers. It's about basically operating a cartel where a single company controls the products of a large number of other companies and illegally binds them for making their own business decisions. Google held/holds the ability to allow or disallow all product releases Android manufacturers release, including products which do not use Google Play Services. Tizen became critical to Samsung because Samsung couldn't release a smart fridge with Android in the background without Google's permission, even if they had no intent on it having a traditional app store... because it might constitute a fork of Android.

flerchin 5y ago

From what I can understand, AFA meant that a manufacturer could lose their license to Google Play Services on _all_ of their devices if they produced _any_ devices using an Android fork. This is a clear abuse of market power.

deleted 5y ago
[deleted]

ApolloFortyNine 5y ago

Meanwhile the only real android competitor is manufactured by one company who doesn't allow even the end user to install apps not directly approved by Apple.

anaganisk 5y ago
Do you really call iOS a competitor to android? Its like saying KIA is competitor to a Rolls Royce. Androids range from 50USD to anything else. Apple and Google makes phones but they’re not competitors, their market segments, user base have different opinions on what they want and do.
- mdoms 5y ago
  Yes iOS is quite obviously a competitor to Android.
  - anaganisk 5y ago
    Not even in nearest terms, Android users mostly dont want to use iOS. Neither do most of the iOS users want to use Android. Like I said, they both are different kind of things of the same technology. Apple is no where near Android in world level in-terms of competition either. Like I said Kia is not a competitor to Rolls Royce.
    - ranguna 5y ago
      Kia is not a competitor to RR because there are loads of luxury car brands that compete with RR and loads of general-to-expensive brands that compete with Kia. In the smartphone OS market, it doesn't matter if apple is on the luxury spectrum and android is on the general spectrum, because they are the only relevant OSs around (excluding harmony because it doesn't have nearly as much market share as those two). So yes, android and iOS are competitors, unless other luxury OS pops up to compete with iOS or OSs like harmony become more relevant to compete with android. If Kia and RR were the only car brands, they'd be competitors of each other because there are "cheap" second hand cars by RR that compete with Kia (like second hand iPhones) and expensive Kia cars that compete with RR (expensive android phones that compete with apple ones).

baybal2 5y ago

Just for a note — JY Lee just cane out from behind the bars a few weeks ago.

pcr910303 5y ago

I think the throwback on HN on this decision is due to the lack of details and context on the news? From what I've understood from the local news (I'm a South Korean), It's not about blocking handsets with forked Android (that already happens regularly AFAIK), but the requirement of shipping Google apps like Chrome and Google Assistant. The big elephant in the room here is Samsung phones, which do ship it's own custom browser Samsung Internet (BTW, with ad blocking capabilities!) and a separate virtual assistant, Bixby. That's the part where the KFTC decided was monopolistic. I don't have a personal opinion this, but seems that the comment threads are focusing on the wrong part. Manufacturers were always able to bundle up their fucked-up version of Android. They were always able to ship super-custom UIs. Google never prevented that... but they did force the UIs bloat by having two separate default apps.

lifthrasiir 5y ago
Also, it should be noted that Google didn't just disallow shipping Google apps to forked Android. Google disallowed shipping Google apps to any devices from vendors that ship forked Android: if your smartwatch is using forked Android your ordinary smartphone also can't have Google apps even when it's using genuine Android. The KFTC made very clear that this is a nuclear all-or-nothing option to hardware vendors and thus constitutes an anti-trust action [1]. [1] https://ftc.go.kr/www/selectReportUserView.do?key=10&rpttype=1&report_data_no=9254 https://ftc.go.kr/www/selectReportUserView.do?key=10&rpttype... (in Korean)
- fennecfoxy 5y ago
  Idk I can somewhat see their reasons. Forked Android isn't necessarily secure: a customer who owns the phone might get hacked or suffer some problem and who will they blame? Not Samsung or Xiaomi etc. They'll blame Google. If you're signed into Google etc on your phone and that is compromised, it appears to the average person that Google messed up.
qutreM 5y ago
> Samsung Internet (BTW, with ad blocking capabilities!) which browser doesn't come with that capability available?

forgotmypw17 5y ago

Who controls the OS controls the browser. Who controls the browser controls the platform. Nothing has changed since the mid-1990s.

slownews45 5y ago

The entire focus on anti-trust and moved to harm to other (big) businesses - no care about the consumer. The Anti-fragmentation agreement google makes these folks sign HELPS consumers. Going to be a crazy situation if that goes away, the app you buy on samsung won't work on HTC etc.

eredengrin 5y ago
If the oems get fragmented enough then it might open up more space for a smaller competitor (ie an open source project) to come fill the gaps, and I certainly wouldn't mind that. Of course it's not a guarantee but I could see it happening - the more dissatisfied the lazy tech nerd segment gets the more we would all band together and try and make the situation better, and also by the competitors becoming more fragmented it might open others up to possibilities they didn't consider previously. (And yes I am putting myself in lazy tech nerd segment at least as far as my phone goes, I've always run cyanogenmod in the past but the last phone I bought I spent a weekend trying to flash lineage and it was annoying enough of a process I ended up back on stock ROM....but I'd certainly be down to try again given the right circumstances.)

urthor 5y ago

The headline makes it look like this is for the benefit of consumers. The article makes it clear this ruling is entirely to the benefit of Samsung Electronics.