4 ms·
Another idea: Before installing an OEM-signed app, send the hash to Google and check if it's on an allowlist.
by ShredKazoo 4y ago
Another idea: Before installing an OEM-signed app, send the hash to Google and check if it's on an allowlist.
- lern_too_spel 4y agoEasier than that. Only the vendor's publisher account should be allowed to sign with the vendor's keys. Implement the same policy for everybody, so if one publisher uploads a package signed with the same keys as another, the original publisher should be notified.