3 ms·

And we have already seen what happens when third party companies go around the Google Play store. You might have heard about this little company https://www.f

And we have already seen what happens when third party companies go around the Google Play store. You might have heard about this little company https://www.forbes.com/sites/ryanwhitwam/2018/08/25/epic-games-has-already-exposed-android-users-to-unacceptable-fortnite-malware-risks/amp/ https://www.forbes.com/sites/ryanwhitwam/2018/08/25/epic-gam...

akira2501 3y ago
It feels like you're trying to use the existence of some criminal acts as a justification for a different set of criminal acts. So, yes, when users literally own their own devices, it is difficult for the manufacturer to keep them perfectly secure without abusing monopoly power. The door also swings the other way here too, because malware has certainly existed _inside_ the Play Store, and it took _users_ to bring it to the billion dollar corporations attention.
- scarface_74 3y ago
  You realize the same company suing Google and saying that allowing third party app stores is the same company that actually introduced a vulnerability by doing so? The entire value proposition of the App Store is the sandbox. But Android security sucks either way
  - tpush 3y ago
    Sandboxing had nothing to with any app store, and Android security empathetically doesn't suck.
    - scarface_74 3y ago
      I just had a coworker say that he surreptitiously installed an app on his son’s phone that allowed him to see everything his son was doing remotely and listen in to his son’s conversations. He showed it to us in action.
      - inkysigma 3y ago
        It's a difficult security model when the threat actor is a parent who presumably has access to the device and in an unlocked state along with permissions to install anything from anywhere. It's not like the threat actor realistically couldn't (with some effort) see everything the child was doing already just by asking so I don't really see this as a very good threat model. Sure, Apple might prevent you from installing such applications on devices (though they offer monitoring app usage and websites for parental controls), but that's just because they have a walled garden that could disallow such apps and it's less clear how to weigh app freedom against user safety. If you're worried about zero days, Android exploits are priced around the same as iOS exploits apparently so take that how you will.
        scarface_74 3y ago
        It’s not a zero day. It’s insecure by design. There is a huge difference between parental control and snooping. You really think you are going to ask a child what are they doing every second and what they talked about and they are going to tell the truth? What’s stopping someone also from surreptitiously installing the same snooping software on another adult’s phone? It’s not less clear. There is no reason to allow this type of software to be installed on a phone without a clear indication that it is on there.
        inkysigma 3y ago
        > You really think you are going to ask a child what are they doing every second and what they talked about and they are going to tell the truth? Of course not, but usually adults can force a passcode out (or take the device altogether) or force the child to sign in for them to see at regular intervals, in which case they can observe everything. I would agree that this is excessive for a parent to do, but clearly the parent you are talking about is already taking excessive measures. > What’s stopping someone also from surreptitiously installing the same snooping software on another adult’s phone? Presumably, an attacker will not have access to the device and not be freely given the password or access with the ability to install an app. If they do, then there's nothing stopping the attacker from just going through the phone. Installing a app without the person's knowledge would either require you to have inside access or have a zero day. > It’s not less clear. There is no reason to allow this type of software to be installed on a phone without a clear indication that it is on there. A lot of the permissions individually make sense and this software could just be composed by a significant number of them. I'm not sure exactly how the software you are referring to works and its scope, so I'll take a narrow example. In the case of messages, users may legitimately want a different messaging app. If the adult just side loads an arbitrary SMS app, how is that supposed to be distinguishable to the OS whether the app additionally happens to sync these messages to a third party? In the case of screen capture, that's a perfectly normal use case to stream your screen. Android does warn you when this is occuring. Or for that matter, many Android devices permit side loading an entire OS. This could be used by the adult to basically bypass any restrictions on apps altogether. This has a completely legitimate use case. Should we block that as well?

akira2501 3y ago

It feels like you're trying to use the existence of some criminal acts as a justification for a different set of criminal acts. So, yes, when users literally own their own devices, it is difficult for the manufacturer to keep them perfectly secure without abusing monopoly power. The door also swings the other way here too, because malware has certainly existed _inside_ the Play Store, and it took _users_ to bring it to the billion dollar corporations attention.

scarface_74 3y ago
You realize the same company suing Google and saying that allowing third party app stores is the same company that actually introduced a vulnerability by doing so? The entire value proposition of the App Store is the sandbox. But Android security sucks either way
- tpush 3y ago
  Sandboxing had nothing to with any app store, and Android security empathetically doesn't suck.
  - scarface_74 3y ago
    I just had a coworker say that he surreptitiously installed an app on his son’s phone that allowed him to see everything his son was doing remotely and listen in to his son’s conversations. He showed it to us in action.
    - inkysigma 3y ago
      It's a difficult security model when the threat actor is a parent who presumably has access to the device and in an unlocked state along with permissions to install anything from anywhere. It's not like the threat actor realistically couldn't (with some effort) see everything the child was doing already just by asking so I don't really see this as a very good threat model. Sure, Apple might prevent you from installing such applications on devices (though they offer monitoring app usage and websites for parental controls), but that's just because they have a walled garden that could disallow such apps and it's less clear how to weigh app freedom against user safety. If you're worried about zero days, Android exploits are priced around the same as iOS exploits apparently so take that how you will.
      - scarface_74 3y ago
        It’s not a zero day. It’s insecure by design. There is a huge difference between parental control and snooping. You really think you are going to ask a child what are they doing every second and what they talked about and they are going to tell the truth? What’s stopping someone also from surreptitiously installing the same snooping software on another adult’s phone? It’s not less clear. There is no reason to allow this type of software to be installed on a phone without a clear indication that it is on there.
        inkysigma 3y ago
        > You really think you are going to ask a child what are they doing every second and what they talked about and they are going to tell the truth? Of course not, but usually adults can force a passcode out (or take the device altogether) or force the child to sign in for them to see at regular intervals, in which case they can observe everything. I would agree that this is excessive for a parent to do, but clearly the parent you are talking about is already taking excessive measures. > What’s stopping someone also from surreptitiously installing the same snooping software on another adult’s phone? Presumably, an attacker will not have access to the device and not be freely given the password or access with the ability to install an app. If they do, then there's nothing stopping the attacker from just going through the phone. Installing a app without the person's knowledge would either require you to have inside access or have a zero day. > It’s not less clear. There is no reason to allow this type of software to be installed on a phone without a clear indication that it is on there. A lot of the permissions individually make sense and this software could just be composed by a significant number of them. I'm not sure exactly how the software you are referring to works and its scope, so I'll take a narrow example. In the case of messages, users may legitimately want a different messaging app. If the adult just side loads an arbitrary SMS app, how is that supposed to be distinguishable to the OS whether the app additionally happens to sync these messages to a third party? In the case of screen capture, that's a perfectly normal use case to stream your screen. Android does warn you when this is occuring. Or for that matter, many Android devices permit side loading an entire OS. This could be used by the adult to basically bypass any restrictions on apps altogether. This has a completely legitimate use case. Should we block that as well?