5 ms·

> either we give them our private signing keys, What is their thread model exactly? Are they aware that Android and the PlayStore is made by Google? Besides,

by Jyaif 2y ago

> either we give them our private signing keys, What is their thread model exactly? Are they aware that Android and the PlayStore is made by Google? Besides, giving Google the keys to sign the APKs allows Google to make tailored APKs for devices with exactly the right ressources, saving bandwidth and disk space for users. I just had a look and right now I see that VLC is shipping hundreds of KB of pngs that are going to be unused, because they are shipping pngs for all the DPIs.

earnesti 2y ago
I have been not developing for app stores, how does exactly this work? Why does Google want the private signing keys? Why it is not some certificate or something?
- watermelon0 2y ago
  Play Store needs to modify APK, to remove unneeded resources, and then repackage and re-sign it with the original signing key. Android requires signature with the same signing key, when updating the application.
  - hnburnsy 2y ago
    So any government can come along and tell Google to repackage a special version of the app for delivery to certain targets or a targeted population? That is seriously messed up, I hope they don't cave.
    - deleted 2y ago
      [deleted]
Hizonner 2y ago
Google is not a unitary entity. The way Google uses those keys forces them to be on, or at least usable from, many machines accessible to many people. That is bad key hygiene, and exposes the keys to many threats of many kinds. The people who maintain Android are not the people who curate the Play Store, nor are they necessarily using exactly the same tools or infrastructure. Letting the Play Store subvert security unilaterally enlarges the human, organizational, and technical attack surface for any number of threat actors. Furthermore it's easier to unobtrusively modify one user's copy of VLC than to modify one user's copy of Android, and also easier to change it back to cover your tracks. All of this significantly increases the chance of the whole system being subverted by any of a variety of threat actors from random rogue employees right on up to nation states. > Besides, giving Google the keys to sign the APKs allows Google to make tailored APKs for devices That could have been done without giving (any part of) Google the keys, using an obscure technique known as "a system design and manifest format that aren't minimum-effort-by-minimum-talent garbage". This is all really, really basic stuff. You don't just go around giving away giant attack surfaces for free. And Google is getting it wrong because doing it right would be slightly inconvenient.
- aleph_minus_one 2y ago
  > Google is not a unitary entity. [...] The people who maintain Android are not the people who curate the Play Store Then the teams should clearly distance themselves from each other. As long as this is not done, the teams have to accept that they are considered to be just "different tentacles of the same evil kraken" by the public.
  - Hizonner 2y ago
    Um, that's totally, utterly irrelevant to anything at all? I do not care about who the public perceives as evil. I care about the number of people who can put me at risk.

by Jyaif 2y ago

earnesti 2y ago

I have been not developing for app stores, how does exactly this work? Why does Google want the private signing keys? Why it is not some certificate or something?

watermelon0 2y ago
Play Store needs to modify APK, to remove unneeded resources, and then repackage and re-sign it with the original signing key. Android requires signature with the same signing key, when updating the application.
- hnburnsy 2y ago
  So any government can come along and tell Google to repackage a special version of the app for delivery to certain targets or a targeted population? That is seriously messed up, I hope they don't cave.
  - deleted 2y ago
    [deleted]

Hizonner 2y ago

Google is not a unitary entity. The way Google uses those keys forces them to be on, or at least usable from, many machines accessible to many people. That is bad key hygiene, and exposes the keys to many threats of many kinds. The people who maintain Android are not the people who curate the Play Store, nor are they necessarily using exactly the same tools or infrastructure. Letting the Play Store subvert security unilaterally enlarges the human, organizational, and technical attack surface for any number of threat actors. Furthermore it's easier to unobtrusively modify one user's copy of VLC than to modify one user's copy of Android, and also easier to change it back to cover your tracks. All of this significantly increases the chance of the whole system being subverted by any of a variety of threat actors from random rogue employees right on up to nation states. > Besides, giving Google the keys to sign the APKs allows Google to make tailored APKs for devices That could have been done without giving (any part of) Google the keys, using an obscure technique known as "a system design and manifest format that aren't minimum-effort-by-minimum-talent garbage". This is all really, really basic stuff. You don't just go around giving away giant attack surfaces for free. And Google is getting it wrong because doing it right would be slightly inconvenient.

aleph_minus_one 2y ago
> Google is not a unitary entity. [...] The people who maintain Android are not the people who curate the Play Store Then the teams should clearly distance themselves from each other. As long as this is not done, the teams have to accept that they are considered to be just "different tentacles of the same evil kraken" by the public.
- Hizonner 2y ago
  Um, that's totally, utterly irrelevant to anything at all? I do not care about who the public perceives as evil. I care about the number of people who can put me at risk.