3 ms·

> which I've done and are quite easy - if anything Did you read the part where it took multiple months to continue because of slow replies and non-working tool

by dewey 2y ago

> which I've done and are quite easy - if anything Did you read the part where it took multiple months to continue because of slow replies and non-working tooling from Google's side? It's also pretty expensive for a relatively niche app, it might be fine if you are Dropbox or a big VC funded Mail app but for smaller companies it's not "easy". > I don't think it's a bad thing that Google is enforcing some minimal security standards. How would Google find out if the version that they are "scanning" is the same one that gets uploaded to the app store on every small app update? Zero, so there's no security benefit.

rammer 2y ago
We've done it too, first time it was hard but it's required and recommended. It raises the bar for low effort hackers and improves security. I disagree with the op. Sorry mate go through the casa audit and get the access .
- dewey 2y ago
  How much was the external audit they are now requiring? As it's most likely not based on company revenue, it's obvious that it's less of an issue for bigger companies who can afford to pay an auditor for their stamp of approval and task a person with talking to Google over a few months every year.
- StewardMcOy 2y ago
  If you read the article, they went through the casa audit, found that it did not improve the security of their app, and came to the conclusion it wasn't worth the time and now money to do it a second time.
  - masklinn 2y ago
    > and came to the conclusion it wasn't worth the time and now money to do it a second time. Especially because they'd now have to go through an other third-party to perform the audit process (not just the security lab, the entire thing), according to the total commander folks[1] that's 75k/year/program. [1] https://www.ghisler.com/googledrivehelp.htm https://www.ghisler.com/googledrivehelp.htm
    - joshuamorton 2y ago
      They say it's "up to 75,000" per program, looking at the actual assessor websites, most require quotes, but tier 2 assessments start at $500 and tier 3 start at $5-6000, and you're in the land of asking for quotes from companies, so "hey we compile the same code into 32 and 64 bit versions" probably does not actually require a 2x cost increase.
- JamesBarney 2y ago
  > It raises the bar for low effort hackers and improves security. There are meaningful ways you can improve the security of your app. There are ways to make sure your app passes CASA. I found very little if any overlap between those two when going through the process.

by dewey 2y ago

rammer 2y ago

We've done it too, first time it was hard but it's required and recommended. It raises the bar for low effort hackers and improves security. I disagree with the op. Sorry mate go through the casa audit and get the access .

dewey 2y ago
How much was the external audit they are now requiring? As it's most likely not based on company revenue, it's obvious that it's less of an issue for bigger companies who can afford to pay an auditor for their stamp of approval and task a person with talking to Google over a few months every year.
StewardMcOy 2y ago
If you read the article, they went through the casa audit, found that it did not improve the security of their app, and came to the conclusion it wasn't worth the time and now money to do it a second time.
- masklinn 2y ago
  > and came to the conclusion it wasn't worth the time and now money to do it a second time. Especially because they'd now have to go through an other third-party to perform the audit process (not just the security lab, the entire thing), according to the total commander folks[1] that's 75k/year/program. [1] https://www.ghisler.com/googledrivehelp.htm https://www.ghisler.com/googledrivehelp.htm
  - joshuamorton 2y ago
    They say it's "up to 75,000" per program, looking at the actual assessor websites, most require quotes, but tier 2 assessments start at $500 and tier 3 start at $5-6000, and you're in the land of asking for quotes from companies, so "hey we compile the same code into 32 and 64 bit versions" probably does not actually require a 2x cost increase.
JamesBarney 2y ago
> It raises the bar for low effort hackers and improves security. There are meaningful ways you can improve the security of your app. There are ways to make sure your app passes CASA. I found very little if any overlap between those two when going through the process.