3 ms·

> But people get it from the official app stores It doesn't matter what "people" do - what matters is whether a third party can obtain the same package and ver

by mjg59 5y ago

> But people get it from the official app stores It doesn't matter what "people" do - what matters is whether a third party can obtain the same package and verify it. And they can! > This claim isn't true - they can read our messages if they want to They can read our messages if they want to, and we can detect that that happened, and then nobody uses their app any more. > Samsung presumably watches out for Google playing naughty games with the Android source Right! And we can watch out for Signal playing naughty games with their source. If you're ok trusting that Samsung will catch Google being untrustworthy, why are you not ok with trusting that signalverifier69's CI toolchain will catch Signal doing the same? The whole point here is that we don't need to trust Signal, we can absolutely verify it.

Andrew_nenakhov 5y ago
Third party getting the package is not a guarantee that you get the same package.
- mjg59 5y ago
  If you've got to the point where Google is specifically pushing you a modified app, Google could just push a backdoored keyboard update that exfiltrated all your keyboard inputs instead. Why bother targeting a single app when you can get everything?
  - mike_hearn 5y ago
    I think Android is designed such that even the Play Store cannot replace an installed app with a differently signed one. Or at least it used to be. And, "Android" is controlled by whoever made your phone, not directly by Google unless it's a Pixel device. That said, it's a thin line. If Google had changed things at some point so that the Play Store could override the signing continuity requirement I wouldn't be remotely surprised.
    - JimDabell 5y ago
      > I think Android is designed such that even the Play Store cannot replace an installed app with a differently signed one. They can’t, however Google have recently changed the requirements for submitting an application to the Play Store. You now need to hand over your application signing key. Instead of signing the application to prove authenticity to Android devices then giving it to Google to host, you now sign the application to provide authenticity to Google, and then Google re-signs it with the key you gave them to prove authenticity to Android devices. So if Google want to provide an alternative binary to a specific person, they can now do that.

by mjg59 5y ago

Andrew_nenakhov 5y ago

Third party getting the package is not a guarantee that you get the same package.

mjg59 5y ago
If you've got to the point where Google is specifically pushing you a modified app, Google could just push a backdoored keyboard update that exfiltrated all your keyboard inputs instead. Why bother targeting a single app when you can get everything?
- mike_hearn 5y ago
  I think Android is designed such that even the Play Store cannot replace an installed app with a differently signed one. Or at least it used to be. And, "Android" is controlled by whoever made your phone, not directly by Google unless it's a Pixel device. That said, it's a thin line. If Google had changed things at some point so that the Play Store could override the signing continuity requirement I wouldn't be remotely surprised.
  - JimDabell 5y ago
    > I think Android is designed such that even the Play Store cannot replace an installed app with a differently signed one. They can’t, however Google have recently changed the requirements for submitting an application to the Play Store. You now need to hand over your application signing key. Instead of signing the application to prove authenticity to Android devices then giving it to Google to host, you now sign the application to provide authenticity to Google, and then Google re-signs it with the key you gave them to prove authenticity to Android devices. So if Google want to provide an alternative binary to a specific person, they can now do that.