7 ms·

My worry here is how the big apps will just publish instructions on how to sideload and then escape the controls and safety that the App Store provides. We know

by hnbear 4y ago

My worry here is how the big apps will just publish instructions on how to sideload and then escape the controls and safety that the App Store provides. We know from years of phishing attacks how easy it is to convince people to click links to non-official sites. The App Store already is doing a poor job at trying to prevent copycat apps, this makes it so much worse. For the majority of my family the App Store provides a huge amount of safety, as no cost. They have no concept of the protections it provides, but equally will just blindly follow instructions online as well. My mother was convinced for years her iMac and MacBook were from Microsoft because every doc she opened said "Microsoft Windows" and she knows Microsoft. Weren't Facebook caught teaching people to use TestFlight to install VPNs to circumvent rules before? This feels like it'll play out similarly to Binance teaching users to install VPNs to circumvent trading controls, for the big official apps, and simultaneously open the floodgates to a ton of spam/phishing/fake apps. Facebook/TikTok/etc just have to say something like "Here's our fancy new version and feature X is only available when you follow these new install instructions" and it'll happen. Then it'll normalize it, which is the worst outcome.

stametseater 4y ago
Just don't do that. Advise your family to not do that. Accept that some of them may choose to anyway, and that's their choice to make. "Think of my elderly mother!" is the apple fanboy's version of "think of the children!" No. Get over it. Talk with your mother and explain your concerns. Do you have power of attorney over your mother? If you think she's too mentally feeble to be responsible for herself, then maybe you should think about that instead of advocating for the imposition of these rules on everybody else. Edit for response: phone8675309: If scammers can talk your mother into sideloading an application, then they can also talk her into emptying her bank account. Get power of attorney over her, if you care.
- phone8675309 4y ago
  The fact that anybody here would say "she's too mentally feeble to be responsible for herself" to "my mom would be confused by this tech thing" really says a lot about the type of people here at Hacker News.
massysett 4y ago
Apple will do all it can to fight this. With third-party keyboards, your iPhone will warn you that the keyboard can steal everything you type into it. Apple will amp up warnings like that and run ad campaigns about the goodness of the App Store and how straying from it will expose you to untold danger. And Apple will probably get pretty far with that. People trust Apple a lot more than they trust Facebook.
- mynameisvlad 4y ago
  > With third-party keyboards, your iPhone will warn you that the keyboard can steal everything you type into it. Once, when you enable the keyboard. And it seems like an entirely sensible warning. It’s a keyboard, by definition it has to have the ability to react to your key presses. Explicitly letting the user know of this risk seems like a good thing.
indymike 4y ago
> The App Store already is doing a poor job at trying to prevent copycat apps, this makes it so much worse. Perhaps, but if it is like Android, users will get plenty of warning when they try to turn on side loading, and every time they get a chance to sideload. > Facebook/TikTok/etc just have to say something like "Here's our fancy new version and feature X is only available when you follow these new install instructions" and it'll happen. 10+ years of Android sideloading and this has not happened.
- jackson1442 4y ago
  I suspect things like this won't happen on their primary apps, but Facebook _has_ already done this on iOS with their Onavo VPN app. They incentivized people (including teenagers) to sideload the Onavo VPN app which would intercept their network traffic for "research" in exchange for a $20 gift card every month. This was done using Facebook's enterprise developer certificate, which allows them to sign apps for internal use - Apple revoked the certificate as it was a violation of ToS to use it externally as they were. https://techcrunch.com/2019/01/30/apple-bans-facebook-vpn/ https://techcrunch.com/2019/01/30/apple-bans-facebook-vpn/
  - hnbear 3y ago
    Thanks - yes, this is what I mistakenly referenced as Test Flight side-loading. It was the enterprise cert, not Test Flight. And yes, they already tried it it as a way around controls.
- AlexandrB 4y ago
  > 10+ years of Android sideloading and this has not happened. Android's permission and anti-tracking measures have generally been more lenient. I'm sure if sideloading was permitted when the anti tracking measures rolled out on iOS Facebook would have jumped to side loading ASAP.
  - celsoazevedo 4y ago
    It's important not to mix App Store/Play Store policies with iOS/Android restrictions. Sideloaded Facebook can't access your location or camera if you don't tell iOS to give them access (iOS restrictions). On the other hand, there's nothing stopping sideloaded Facebook from refusing to work if you don't let them access those things (no App Store rules). Something else to consider is the fact that the average user only installs apps from the default store. If Facebook wants installs, that's where they have to be. Also, we don't know many "scary screens" Apple will display when trying to sideload something.
softfalcon 4y ago
I worry about this kind of thing even with my family who are filled with tech elites. Being tech savvy does not mean being security savvy. The amount of times I've had to convince my family that yes, you do have to update your OS, your devices, your password manager, etc is maddening. Hardly anyone cares about security over convenience. I foresee that Meta will make a dedicated landing page with a side-load download + easy steps and it will get adopted by a size-able chunk of people (like you say). Once that side-loaded app is on the device, they will have auto-update features built-in and you'll likely never need to manually install it ever again. They'll essentially have complete rooted control over your device and use it to steal any and all information possible. This is a very real reality and I don't think folks care enough. I'm not even against opening up the app store(s), I just wish we had regulated social media's permissions to our private life more before we opened the flood gates to the garbage they will now attempt to dump onto our devices.
- mhoad 4y ago
  I mean we don’t have to treat this like some hypothetical. They could already do that via Android for years and they didn’t…
- boring_twenties 3y ago
  > complete rooted control I highly doubt that sideloaded apps would somehow be granted root by default
greiskul 4y ago
> My worry here is how the big apps will just publish instructions on how to sideload and then escape the controls and safety that the App Store provides. Android has sideloading since forever, and this doesn't happen there. The number of users you get by the convenience of being in the main app store for the system is way bigger then from any feature you can do if you are not.
- pulvinar 4y ago
  As others have pointed out, Google Play isn't as locked down as the App Store so there isn't the same incentive. But the biggest question that always gets me is why anyone who considers the Android way fine would want to change Apple? Simply stay with Android and let others be. Changing Apple makes it just another Android-- you can't have your cake and eat it too.
  - waboremo 4y ago
    Exactly, you can't have your cake and eat it too. If you want to see yourself as a platform, you must hold yourself to higher standards as a platform. Hence, the DOJ ruling that restricting access to the platform is anti-competitive. This is also why Google is under pressure as well. This isn't just a "go to Android" situation, this is a "the entire mobile market is entirely anti-competitive due to Apple and Google being in bed with each other" one.
    - pulvinar 3y ago
      Yep, serves them right for making desirable products. Odd that I don't remember anyone calling Nokia anti-competitive when their platform had the market sewn up and Apple and Google had 0%.
jeroenhd 4y ago
Tech illiterate people are barely installing new apps on their phones, let alone separate app stores. Almost everyone I know runs Android and I've never seen F-Droid or Aurora or any other alternative app store on their phones. Scammers can already trick your mother into installing their apps. https://altstore.io/ https://altstore.io/ exists and is widely used to install an emulator and some other apps Apple has deemed unworthy of their users' attention. The source is here: https://github.com/altstoreio/AltStore https://github.com/altstoreio/AltStore
- kiratp 4y ago
  > Tech illiterate people are barely installing new apps on their phones, let alone separate app stores. Can you back that up with data? My family’s phones are full of apps.
  - hnbear 3y ago
    Yes, I find the tech illiterate tend to be less selective, and just install a ton of crap. The highly tech literate are more picky and have fewer more specific apps. Backed-up with zero data, based on anecdata from friends.
Gareth321 4y ago
There are plenty of scams on the App Store itself. And it's not like one needs apps to scam people. The internet is full of scams and iPhones come with Safari. Unless you prevent your family from going on the internet, they'll find a way to get scammed. The solution here is education.

by hnbear 4y ago

stametseater 4y ago

Just don't do that. Advise your family to not do that. Accept that some of them may choose to anyway, and that's their choice to make. "Think of my elderly mother!" is the apple fanboy's version of "think of the children!" No. Get over it. Talk with your mother and explain your concerns. Do you have power of attorney over your mother? If you think she's too mentally feeble to be responsible for herself, then maybe you should think about that instead of advocating for the imposition of these rules on everybody else. Edit for response: phone8675309: If scammers can talk your mother into sideloading an application, then they can also talk her into emptying her bank account. Get power of attorney over her, if you care.

phone8675309 4y ago
The fact that anybody here would say "she's too mentally feeble to be responsible for herself" to "my mom would be confused by this tech thing" really says a lot about the type of people here at Hacker News.

massysett 4y ago

Apple will do all it can to fight this. With third-party keyboards, your iPhone will warn you that the keyboard can steal everything you type into it. Apple will amp up warnings like that and run ad campaigns about the goodness of the App Store and how straying from it will expose you to untold danger. And Apple will probably get pretty far with that. People trust Apple a lot more than they trust Facebook.

mynameisvlad 4y ago
> With third-party keyboards, your iPhone will warn you that the keyboard can steal everything you type into it. Once, when you enable the keyboard. And it seems like an entirely sensible warning. It’s a keyboard, by definition it has to have the ability to react to your key presses. Explicitly letting the user know of this risk seems like a good thing.

indymike 4y ago

> The App Store already is doing a poor job at trying to prevent copycat apps, this makes it so much worse. Perhaps, but if it is like Android, users will get plenty of warning when they try to turn on side loading, and every time they get a chance to sideload. > Facebook/TikTok/etc just have to say something like "Here's our fancy new version and feature X is only available when you follow these new install instructions" and it'll happen. 10+ years of Android sideloading and this has not happened.

jackson1442 4y ago
I suspect things like this won't happen on their primary apps, but Facebook _has_ already done this on iOS with their Onavo VPN app. They incentivized people (including teenagers) to sideload the Onavo VPN app which would intercept their network traffic for "research" in exchange for a $20 gift card every month. This was done using Facebook's enterprise developer certificate, which allows them to sign apps for internal use - Apple revoked the certificate as it was a violation of ToS to use it externally as they were. https://techcrunch.com/2019/01/30/apple-bans-facebook-vpn/ https://techcrunch.com/2019/01/30/apple-bans-facebook-vpn/
- hnbear 3y ago
  Thanks - yes, this is what I mistakenly referenced as Test Flight side-loading. It was the enterprise cert, not Test Flight. And yes, they already tried it it as a way around controls.
AlexandrB 4y ago
> 10+ years of Android sideloading and this has not happened. Android's permission and anti-tracking measures have generally been more lenient. I'm sure if sideloading was permitted when the anti tracking measures rolled out on iOS Facebook would have jumped to side loading ASAP.
- celsoazevedo 4y ago
  It's important not to mix App Store/Play Store policies with iOS/Android restrictions. Sideloaded Facebook can't access your location or camera if you don't tell iOS to give them access (iOS restrictions). On the other hand, there's nothing stopping sideloaded Facebook from refusing to work if you don't let them access those things (no App Store rules). Something else to consider is the fact that the average user only installs apps from the default store. If Facebook wants installs, that's where they have to be. Also, we don't know many "scary screens" Apple will display when trying to sideload something.

softfalcon 4y ago

I worry about this kind of thing even with my family who are filled with tech elites. Being tech savvy does not mean being security savvy. The amount of times I've had to convince my family that yes, you do have to update your OS, your devices, your password manager, etc is maddening. Hardly anyone cares about security over convenience. I foresee that Meta will make a dedicated landing page with a side-load download + easy steps and it will get adopted by a size-able chunk of people (like you say). Once that side-loaded app is on the device, they will have auto-update features built-in and you'll likely never need to manually install it ever again. They'll essentially have complete rooted control over your device and use it to steal any and all information possible. This is a very real reality and I don't think folks care enough. I'm not even against opening up the app store(s), I just wish we had regulated social media's permissions to our private life more before we opened the flood gates to the garbage they will now attempt to dump onto our devices.

mhoad 4y ago
I mean we don’t have to treat this like some hypothetical. They could already do that via Android for years and they didn’t…
boring_twenties 3y ago
> complete rooted control I highly doubt that sideloaded apps would somehow be granted root by default

greiskul 4y ago

> My worry here is how the big apps will just publish instructions on how to sideload and then escape the controls and safety that the App Store provides. Android has sideloading since forever, and this doesn't happen there. The number of users you get by the convenience of being in the main app store for the system is way bigger then from any feature you can do if you are not.

pulvinar 4y ago
As others have pointed out, Google Play isn't as locked down as the App Store so there isn't the same incentive. But the biggest question that always gets me is why anyone who considers the Android way fine would want to change Apple? Simply stay with Android and let others be. Changing Apple makes it just another Android-- you can't have your cake and eat it too.
- waboremo 4y ago
  Exactly, you can't have your cake and eat it too. If you want to see yourself as a platform, you must hold yourself to higher standards as a platform. Hence, the DOJ ruling that restricting access to the platform is anti-competitive. This is also why Google is under pressure as well. This isn't just a "go to Android" situation, this is a "the entire mobile market is entirely anti-competitive due to Apple and Google being in bed with each other" one.
  - pulvinar 3y ago
    Yep, serves them right for making desirable products. Odd that I don't remember anyone calling Nokia anti-competitive when their platform had the market sewn up and Apple and Google had 0%.

jeroenhd 4y ago

Tech illiterate people are barely installing new apps on their phones, let alone separate app stores. Almost everyone I know runs Android and I've never seen F-Droid or Aurora or any other alternative app store on their phones. Scammers can already trick your mother into installing their apps. https://altstore.io/ https://altstore.io/ exists and is widely used to install an emulator and some other apps Apple has deemed unworthy of their users' attention. The source is here: https://github.com/altstoreio/AltStore https://github.com/altstoreio/AltStore

kiratp 4y ago
> Tech illiterate people are barely installing new apps on their phones, let alone separate app stores. Can you back that up with data? My family’s phones are full of apps.
- hnbear 3y ago
  Yes, I find the tech illiterate tend to be less selective, and just install a ton of crap. The highly tech literate are more picky and have fewer more specific apps. Backed-up with zero data, based on anecdata from friends.

Gareth321 4y ago

There are plenty of scams on the App Store itself. And it's not like one needs apps to scam people. The internet is full of scams and iPhones come with Safari. Unless you prevent your family from going on the internet, they'll find a way to get scammed. The solution here is education.