4 ms·
Also means any user can be selectively targeted with a compromised app signed by the correct key. If you use pretty much anything other than Linux (and even th
by api 3y ago
Also means any user can be selectively targeted with a compromised app signed by the correct key.
If you use pretty much anything other than Linux (and even that with care) there is a rather long list of people who effectively have root on all your stuff.
Maybe this can’t be avoided. Economies and civilizations run on division of labor and interdependency. I just think it’s important that people understand this. Most people don’t and think they have far more digital security and privacy than they do.
- rvnx 3y agoDisabling auto-updates is a controversial but nice way to prevent backdoors from getting added, or for software to turn becoming malicious. For example, Chrome extensions, it's crazy that a random guy, can automatically update its piece of JS, just to steal all credentials, and there is no mechanism to disable that (or very well hidden) (like what happened with "The Great Suspender", though it was a great extension)
- klooney 3y agoIt's not clear that the vendors will respect that when the going gets tough, or that they don't have "no just force the update" channels. I think Apple has done that, for instance.
- denysvitali 3y agoYou can still remotely install apps with the Play services. This is effectively a RCE (if you have access to the target Google account)