4 ms·

How, in the utter fuck, does this get past app review? It’s not like it’s an edge case either, there are hundreds of apps with obviously and blatantly misleadi

by tailspin2019 3y ago

How, in the utter fuck, does this get past app review? It’s not like it’s an edge case either, there are hundreds of apps with obviously and blatantly misleading logos, brands, names etc. Just see ChatGPT / OpenAi for example. I have taken to sharing direct links to Apps in the app store now when recommending things to non-technical friends/family, because I’ve lost all confidence that they will find the “correct” app anymore just by searching, and not one of hundreds of highly dubious clone apps. Difficult to argue against the recent actions of the EU when the supposed benefits of the walled garden are crumbling anyway…

mdaniel 3y ago
Also, I somehow got the impression that one needed to provide Apple with live credentials to exercise any cloud service that the app fronts; so that makes me wonder if the malicious actor bought a LastPass subscription just to allow Apple to phish themselves?
- donmcronald 3y ago
  I wouldn't be surprised. The issuers of code signing certificates used to ask the person getting the cert to provide links to public registries of business / phone number listings. I had it happen to me. A lot of the "security" industry is a big scam designed to take your money. Many of the products they sell don't work because they don't have the ability to filter out bad actors. What's the value of a code signing certificate if someone can spin up a company in a corrupt country and get an EV code signing cert for that businesses? The answer is $0.
euroderf 3y ago
Does not the word review in sentence one needs irony quotes.
sccxy 3y ago
Yeah, and my app got rejected because it links to other webpage...
deleted 3y ago
[deleted]
donmcronald 3y ago
There are so many scams on every platform that it's ridiculous. I think the gatekeepers are responsible for it TBH. Prior to big tech usurping control over distribution, a lot more effort went into branding and direct distribution of apps. People understood the difference between lastpass.com and totallynotfakelastpass.com. Then big tech started obscuring identity and trust information in an effort to push users towards their gateways (Google search, Apple app store, etc) instead. And here we are, in a world filled with users that can't help themselves because they've been systematically dumbed-down by big tech. We're on the 2nd generation of users that have been trained to trust the app store which is little more than a big search engine due to the volume. I would compare it to searching for an app on Google and installing whatever shows up high in the results. The average user doesn't have the tools to discover the trustworthiness of individual developers, and haven't for ~15 years, which has led to a situation where no one (normal) could assess things properly even if you gave them the tools they need.
- throwitaway1123 3y ago
  > People understood the difference between lastpass.com and totallynotfakelastpass.com. The Domain Name System has its flaws, but it's honestly kind of a miracle that we arrived at a system that's easy for users to remember (compared to numeric phone numbers), while remaining relatively decentralized.
bradly 3y ago
If you reviewed at the fraud listing[1] and had no knowledge of the LastPass app, I'm not sure you would know it was a copy. I worked on the App Store and Music at Apple, but I have no idea about the app review process. 1. https://blog.lastpass.com/wp-content/uploads/sites/20/2024/0 https://blog.lastpass.com/wp-content/uploads/sites/20/2024/0...
- saurik 3y ago
  If you aren't putting the effort in to verify anything or doing enough research to even like, see if there is an existing app or that this app is related to the real website, then you simply can't claim--as Apple does--to be screening the apps that are submitted for scale. Like, are you suggesting that the goal of the App Store's walled garden is merely to prevent obvious scams?!
  - bradly 3y ago
    > see if there is an existing app or that this app is related to the real website I’m still not sure what you are suggesting a reviewer unfamiliar with LastPass to know.
    - saurik 3y ago
      I am expecting the reviewer to spend a moment at least searching their own store for LastPass, in addition to searching Google and checking the credibility of the submitter. Why, pray tell, do you think the reviewer even deserves to exist if they cannot block this sort of scam, due to something as trivial a reason as "they hadn't personally heard of LastPass"? There is a good reason why the FTC has finally decided to call bullshit on companies like Apple who claim their centralized closed ecosystem and resulting anti-competitive market manipulation is "required" for safety / security: you even used to work for Apple, and are essentially admitting they can't possibly do this function!!
      - bradly 3y ago
        This is human judgment. There are going to be failures. I believe a closed ecosystem is safer. You do not. Great! Let's each support the company that gives us that. <3

mdaniel 3y ago

Also, I somehow got the impression that one needed to provide Apple with live credentials to exercise any cloud service that the app fronts; so that makes me wonder if the malicious actor bought a LastPass subscription just to allow Apple to phish themselves?

donmcronald 3y ago
I wouldn't be surprised. The issuers of code signing certificates used to ask the person getting the cert to provide links to public registries of business / phone number listings. I had it happen to me. A lot of the "security" industry is a big scam designed to take your money. Many of the products they sell don't work because they don't have the ability to filter out bad actors. What's the value of a code signing certificate if someone can spin up a company in a corrupt country and get an EV code signing cert for that businesses? The answer is $0.

euroderf 3y ago

Does not the word review in sentence one needs irony quotes.

sccxy 3y ago

Yeah, and my app got rejected because it links to other webpage...

deleted 3y ago

[deleted]

donmcronald 3y ago

There are so many scams on every platform that it's ridiculous. I think the gatekeepers are responsible for it TBH. Prior to big tech usurping control over distribution, a lot more effort went into branding and direct distribution of apps. People understood the difference between lastpass.com and totallynotfakelastpass.com. Then big tech started obscuring identity and trust information in an effort to push users towards their gateways (Google search, Apple app store, etc) instead. And here we are, in a world filled with users that can't help themselves because they've been systematically dumbed-down by big tech. We're on the 2nd generation of users that have been trained to trust the app store which is little more than a big search engine due to the volume. I would compare it to searching for an app on Google and installing whatever shows up high in the results. The average user doesn't have the tools to discover the trustworthiness of individual developers, and haven't for ~15 years, which has led to a situation where no one (normal) could assess things properly even if you gave them the tools they need.

throwitaway1123 3y ago
> People understood the difference between lastpass.com and totallynotfakelastpass.com. The Domain Name System has its flaws, but it's honestly kind of a miracle that we arrived at a system that's easy for users to remember (compared to numeric phone numbers), while remaining relatively decentralized.

bradly 3y ago

If you reviewed at the fraud listing[1] and had no knowledge of the LastPass app, I'm not sure you would know it was a copy. I worked on the App Store and Music at Apple, but I have no idea about the app review process. 1. https://blog.lastpass.com/wp-content/uploads/sites/20/2024/0 https://blog.lastpass.com/wp-content/uploads/sites/20/2024/0...

saurik 3y ago
If you aren't putting the effort in to verify anything or doing enough research to even like, see if there is an existing app or that this app is related to the real website, then you simply can't claim--as Apple does--to be screening the apps that are submitted for scale. Like, are you suggesting that the goal of the App Store's walled garden is merely to prevent obvious scams?!
- bradly 3y ago
  > see if there is an existing app or that this app is related to the real website I’m still not sure what you are suggesting a reviewer unfamiliar with LastPass to know.
  - saurik 3y ago
    I am expecting the reviewer to spend a moment at least searching their own store for LastPass, in addition to searching Google and checking the credibility of the submitter. Why, pray tell, do you think the reviewer even deserves to exist if they cannot block this sort of scam, due to something as trivial a reason as "they hadn't personally heard of LastPass"? There is a good reason why the FTC has finally decided to call bullshit on companies like Apple who claim their centralized closed ecosystem and resulting anti-competitive market manipulation is "required" for safety / security: you even used to work for Apple, and are essentially admitting they can't possibly do this function!!
    - bradly 3y ago
      This is human judgment. There are going to be failures. I believe a closed ecosystem is safer. You do not. Great! Let's each support the company that gives us that. <3