4 ms·

What is "signed by Android"? The leaked Samsung and LG keys are used in dozens of apps. Someone could in theory upload apps but claimed by Samsung on the Play S

What is "signed by Android"? The leaked Samsung and LG keys are used in dozens of apps. Someone could in theory upload apps but claimed by Samsung on the Play Store, sign them with those keys, and compromise millions of users whose Play Store would suddenly update to the unofficial APKs (assuming that they get around Google's own Play Protect).

jeroenhd 4y ago
I assume (hope) that Google is smart enough to check for these vendor signatures, and possibly tie them to a specific vendor account. With the switch to aab app bundles (https://android-developers.googleblog.com/2020/11/new-android-app-bundle-and-target-api.html?m=1 https://android-developers.googleblog.com/2020/11/new-androi...), it's effectively impossible for most people to upload custom APKs to the Play Store anyway. I'm sure there are backdoor and special treatment for vendor applications to keep their signatures. In fact, with the exception of private applications, Google requires you to hand over your signing keys when you upload to the play store. I doubt you'd get away with just uploading vendor keys to the Play Store console.
- archon810 4y ago
  Where do you see that Google requires you to hand over the signing keys? That's one of the options, but you can also sign and then upload a signed apk.
  - jeroenhd 4y ago
    https://developer.android.com/studio/publish/app-signing#enroll https://developer.android.com/studio/publish/app-signing#enr... Since 2011, GPlay requires you to use Play Signing. You can have Google generate the keys or you can upload your own keys, but the private key ends up with Google. You can create a key pair for uploading artifacts (the "upload key") for which you only need to upload the public key, but the signing keys need to end up over at Google. Older apps (uploaded before August 2021) are exempt, though. Apps distributed through other channels (F-Droid, Amazon App Store, etc.) are also exempt, of course.
    - archon810 4y ago
      Ah, so having to upload the key is new as of Aug 2021. If Google is indeed smart about it, they'd have blocked these compromised keys from being used by developers other than the whitelisted ones.

jeroenhd 4y ago

I assume (hope) that Google is smart enough to check for these vendor signatures, and possibly tie them to a specific vendor account. With the switch to aab app bundles (https://android-developers.googleblog.com/2020/11/new-android-app-bundle-and-target-api.html?m=1 https://android-developers.googleblog.com/2020/11/new-androi...), it's effectively impossible for most people to upload custom APKs to the Play Store anyway. I'm sure there are backdoor and special treatment for vendor applications to keep their signatures. In fact, with the exception of private applications, Google requires you to hand over your signing keys when you upload to the play store. I doubt you'd get away with just uploading vendor keys to the Play Store console.

archon810 4y ago
Where do you see that Google requires you to hand over the signing keys? That's one of the options, but you can also sign and then upload a signed apk.
- jeroenhd 4y ago
  https://developer.android.com/studio/publish/app-signing#enroll https://developer.android.com/studio/publish/app-signing#enr... Since 2011, GPlay requires you to use Play Signing. You can have Google generate the keys or you can upload your own keys, but the private key ends up with Google. You can create a key pair for uploading artifacts (the "upload key") for which you only need to upload the public key, but the signing keys need to end up over at Google. Older apps (uploaded before August 2021) are exempt, though. Apps distributed through other channels (F-Droid, Amazon App Store, etc.) are also exempt, of course.
  - archon810 4y ago
    Ah, so having to upload the key is new as of Aug 2021. If Google is indeed smart about it, they'd have blocked these compromised keys from being used by developers other than the whitelisted ones.