2 ms·

> So you can reach even people without the Play Store and with degoogled systems How would Google install the apps on the devices without the Play Store? Even

• g-b-r 3y ago
  You seem to have completely misunderstood what I said It's the app updates that become an easy attack avenue if Google has their signing keys. It's actually always been possible for Google to replace the initial installation packages (and if did, then also their future updates). For this initial installation it might be a little easier for the user to verify that he has an untampered package. But most of all, in most cases, someone becomes the object of an investigation at a moment when he already has an app you'd like to subvert installed. Anyhow, when Google wasn't provided the keys, if you initially received the real package, all successive updates were guaranteed to come from the developer (unless the developer itself got compromised). For many apps it's already extremely interesting for law enforcement to provide a slightly modified version, with not even a need for additional permissions: for all E2EE apps, for example, it might well be that all you want is to exfiltrate their encryption keys. By the way, at least if the Play Store is installed, Google is able to install updates surreptitiously: "If it is determined, however, that the Update will fix a critical security vulnerability or critical operability issue related to the Content, or will prevent abuse, the Update may be completed irrespective of your Update settings in Google Play or your Device."