4 ms·

It's essentially a mandatory backdoor. It means that Google has the capability to modify application code, and there's no longer a mitigation for this attack ve

by buu700 3y ago

It's essentially a mandatory backdoor. It means that Google has the capability to modify application code, and there's no longer a mitigation for this attack vector available to developers. Hypothetically, Google might be compelled by a government to deploy a malicious update to an app for surveillance purposes. It might also be seen as anticompetitive, in the sense that Google is the only entity which can manage its own keys for new apps, making new non-Google apps inherently less secure.

lern_too_spel 3y ago
> It means that Google has the capability to modify application code The Play Store has system signature, so it could already do that. The mitigation is on the user's side to disable the Play Store, which is where it has always been. > It might also be seen as anticompetitive, in the sense that Google is the only entity which can manage its own keys Only if they distribute through the Play Store. The whole point of the recent lawsuit is to make it easier for anybody else to distribute apps under their own control.
- g-b-r 3y ago
  Google having the keys of all the apps on the store make all of them subvertible. So you can reach even people without the Play Store and with degoogled systems, unless they only use apps from other sources. That's both a serious problem for not so few people, and a very useful attack avenue for law enforcement.
  - lern_too_spel 3y ago
    > So you can reach even people without the Play Store and with degoogled systems How would Google install the apps on the devices without the Play Store? Even if it somehow tricked the user into installing the app, it would require the user to approve any additional permissions that the subverted app requests.
    - g-b-r 3y ago
      You seem to have completely misunderstood what I said It's the app updates that become an easy attack avenue if Google has their signing keys. It's actually always been possible for Google to replace the initial installation packages (and if did, then also their future updates). For this initial installation it might be a little easier for the user to verify that he has an untampered package. But most of all, in most cases, someone becomes the object of an investigation at a moment when he already has an app you'd like to subvert installed. Anyhow, when Google wasn't provided the keys, if you initially received the real package, all successive updates were guaranteed to come from the developer (unless the developer itself got compromised). For many apps it's already extremely interesting for law enforcement to provide a slightly modified version, with not even a need for additional permissions: for all E2EE apps, for example, it might well be that all you want is to exfiltrate their encryption keys. By the way, at least if the Play Store is installed, Google is able to install updates surreptitiously: "If it is determined, however, that the Update will fix a critical security vulnerability or critical operability issue related to the Content, or will prevent abuse, the Update may be completed irrespective of your Update settings in Google Play or your Device."

by buu700 3y ago

lern_too_spel 3y ago

> It means that Google has the capability to modify application code The Play Store has system signature, so it could already do that. The mitigation is on the user's side to disable the Play Store, which is where it has always been. > It might also be seen as anticompetitive, in the sense that Google is the only entity which can manage its own keys Only if they distribute through the Play Store. The whole point of the recent lawsuit is to make it easier for anybody else to distribute apps under their own control.

g-b-r 3y ago
Google having the keys of all the apps on the store make all of them subvertible. So you can reach even people without the Play Store and with degoogled systems, unless they only use apps from other sources. That's both a serious problem for not so few people, and a very useful attack avenue for law enforcement.
- lern_too_spel 3y ago
  > So you can reach even people without the Play Store and with degoogled systems How would Google install the apps on the devices without the Play Store? Even if it somehow tricked the user into installing the app, it would require the user to approve any additional permissions that the subverted app requests.
  - g-b-r 3y ago
    You seem to have completely misunderstood what I said It's the app updates that become an easy attack avenue if Google has their signing keys. It's actually always been possible for Google to replace the initial installation packages (and if did, then also their future updates). For this initial installation it might be a little easier for the user to verify that he has an untampered package. But most of all, in most cases, someone becomes the object of an investigation at a moment when he already has an app you'd like to subvert installed. Anyhow, when Google wasn't provided the keys, if you initially received the real package, all successive updates were guaranteed to come from the developer (unless the developer itself got compromised). For many apps it's already extremely interesting for law enforcement to provide a slightly modified version, with not even a need for additional permissions: for all E2EE apps, for example, it might well be that all you want is to exfiltrate their encryption keys. By the way, at least if the Play Store is installed, Google is able to install updates surreptitiously: "If it is determined, however, that the Update will fix a critical security vulnerability or critical operability issue related to the Content, or will prevent abuse, the Update may be completed irrespective of your Update settings in Google Play or your Device."