6 ms·

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defe

by leoedin 11mo ago

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. How does Google know if someone has sold off their app? In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.

niutech 11mo ago
In many cases developer e-mail address changes, IP address changes, billing address changes, tax ID changes...
- rollcat 11mo ago
  This exactly. Transferring ownership is a business transaction. Track that. If the new owner is trying to hide it, this is fraud, and should be dealt with in court.
4u00u 11mo ago
To be fair, on Google Play you have the option to transfer the app to someone else's account. People don't need to trade accounts...
- nandomrumber 11mo ago
  That doesn’t help mitigate the class of attack you responded to.
lopis 11mo ago
If an app updates to require new permissions, or to suddenly require network access, or the owner contact details change, Google Play should ideally stop that during the update review process and let the users know. But that wouldn't be good for business.
- _cenw 11mo ago
  This is a huge problem in the Chrome Web Store and Google is doing very little about it. If you ever made an extension that is even just a little popular, expect to get acquisition offers by people who want to add malicious features somewhere between click fraud, residential IP services or even password stealers.
  - babuskov 11mo ago
    Same for Play Store. I have 2 games and I keep getting offers all the time. The last one offered $2000 for the developer account or a $100 monthly rent. From their email pitch: > We’re now offering from $500 to $2000 for a one-time purchase of a developer account that includes apps, or a rental deal starting from $100. > No hidden conditions — quick process, secure agreement, and immediate payment upon verification. > We’re simply looking for reliable accounts to publish our client apps quickly, and yours could be a perfect match.
- bmacho 11mo ago
  Indeed, an update can't be more malicious than the permissions allow it to be. You have a calculator app with limited permissions, it is "safe" to set to allow the developer to update it. No danger in that. But I don't think it is enough, or it is the right model. In other cases, when the app has dangerous permissions already, auto-update should be a no-go.
  - cesarb 11mo ago
    > Indeed, an update can't be more malicious than the permissions allow it to be. ...in the absence of sandbox escape bugs.
- fauigerzigerk 11mo ago
  >...or to suddenly require network access... That's the most baffling thing to me. There is simply no option to remove network permissions from any app on my Pixel phone. It's one of the reasons why I avoid using mobile apps whenever I can.
rixed 11mo ago
> which is widely promoted as being good security practice Maybe that's the mistake right there? It is a good practice only as long as you can trust the remote source for apps. Illustration: it is a good security practice for a Debian distro, not so much for a closed source phone app store.
- eMPee584 11mo ago
  OPEN SOURCE EVERYTHING is the premier solution.. again.
bmacho 11mo ago
> I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. These are not compatible, but only because the first half is simply false. Allowing a developer to send updates is not "good" but "bad" security practice.
Aissen 11mo ago
By using the distributor model, where a trusted 3rd party builds & distributes the apps. Like every Linux distro or like what F-droid does.
GuB-42 11mo ago
The point here is that app developers have to identify themselves. Google has no intention to verify the content of sideloaded apps, just that it is signed by a real person, for accountability. They don't know if the person who signed the app is the developer, but should the app happen to be a scam and there is a police investigation, that is the person who will have to answer questions, like "who did you transfer these private keys to?". This, according to Google and possibly regulators in countries where this will be implemented, will help combat a certain type of scam. It shouldn't be a problem for YouTube Vanced, at least in the proposed form. The authors, who are already idendified just need to sign their APK. AFAIK, what they are doing is not illegal or they would have been shut down long ago. It may be a problem for others though, and particularly F-Droid, because F-Droid recompiles apps, they can't reasonably be signed by the original author. The F-Droid situation can resolve itself if F-Droid is allowed to sign the apps it publishes, and in fact, doing that is an improvement in security as it can be a guarantee that the APK you got is indeed the one compiled by F-Droid from publicly available source code.
- sharperguy 11mo ago
  APKs are already signed. Now Google requries that they be signed by a key which is verified by their own signatures. Which means they can selectively refused to verify whichever keys are inconvenient to them.
- tcfhgj 11mo ago
  > Google has no intention to verify the content of sideloaded apps, just that it is signed by a real person, for accountability. for now
- raxxorraxor 11mo ago
  Still believe that signing binaries this way is always bullshit. I stopped developing for mobile systems ages ago because it just isn't fun anymore and the devices are vastly more useless. As a user, I don't use apps anymore either. But you can bet I won't ever id myself to Google as a dev.
maybewhenthesun 11mo ago
That's true in theory. But as you can see in practice is that google does very little to protect their users, while F-Droid at least tries. Which shows that the whole 'security' rigmarole by google is bullshit.
mid-kid 11mo ago
> F-Droid couldn't know either F-Droid is not just a repository and an organization providing the relevant services, but a community of like-minded *users* that report on and talk about such issues.
jlokier 11mo ago
> In most cases, F-Droid couldn't know either. F-Droid is quite restrictive about what kinds of app they accept, they build the app from source code themselves, and the source code must be published under a FLOSS license. They have some checks that have to pass for each new version of an app. Although it's possible for a developer to transfer their accounts and private keys to someone shady, F-Droid's checks and open source requirements limit the damage the new developer can do. https://f-droid.org/docs/Inclusion_Policy/ https://f-droid.org/docs/Inclusion_Policy/ https://f-droid.org/docs/Anti-Features/ https://f-droid.org/docs/Anti-Features/
- Sophira 11mo ago
  One thing worth noting, these checks and restrictions only apply if you're using the original F-Droid repository. Many times I've seen the IzzyOnDroid repository recommended, but that repo explicitly gives you the APKs from the original developers, so you don't get these benefits.
  - Zak 11mo ago
    That's true. The whole point of an open ecosystem is that you get to decide who you get your software from. You can decide on the official F-Droid repository and get the benefits and drawbacks of a strict open source rule with the F-Droid organization's curation if that's your preference. You can add other repositories with different curation if you prefer that.
- Hizonner 11mo ago
  You know what? That's bullshit. Anybody slightly competent can put horrendous back doors into any code, in such a way that they will pass F-Droid's "checks", Apple's "checks", and Google's "checks". Source code is barely a speed bump. Behavioral tests are a joke.
  - johnnyanmac 11mo ago
    Anyone determined enough can break into any house. If not through ingenuitiy, then by a brick to your window. Doesn't mean we shouldn't lock our doors, turn off our lights, and close our curtains anyway. The fortunate thing is that 99% of people won't bother trying to break your app if it's not dead simple. Advanved security mechanisms to check for backdoors is probably something only billionaire tech companies need to worry about.
fukka42 11mo ago
Quite simple: Actual human review that works with the developers. But this costs money, and the lack of it is proof google doesn't really care about user security. They're just lying.
bogwog 11mo ago
> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected. 1. The Android OS does not allow installing app updates if the new APK uses a different signing key than the existing one. It will outright refuse, and this works locally on device. There's no need to ask some third party server to verify anything. It's a fundamental part of how Android security works, and it has been like this since the first Android phone ever release. 2. F-Droid compiles all APKs on its store, and signs them with its own keys. Apps on F-Droid are not signed by the developers of those apps. They're signed by F-Droid, and thus can only be updated through and by F-Droid. F-Droid does not just distribute APKs uploaded by random people, it distributes APKs that F-Droid compiled themselves. So to answer your question, a developer transferring their accounts/keys to someone else doesn't matter. It won't affect the security of F-Droid users, because those keys/accounts aren't used by F-Droid. The worst that can happen is that the new owner tries injecting malware into the source code, but F-Droid builds apps from source and is thus positioned to catch those types of things (which is more than can be said about Google's ability to police Google Play) And finally, > How does Google know if someone has sold off their app? Google should not know anything about the business dealings of potential competitors. Google is a monopoly[1], so there is real risk for developers and their businesses if Google is given access to this kind of information. [1]: https://www.google.com/search?q=is+google+a+monopoly%3F&udm=50&mstk=AUtExfDLG5sfvIlKGBZeuTby2uBqPcLitjLPRlFfqQK1gbWckPsavj74yAa93s9aKsY6Twmk5I3Nxtaw257ul5CvoJZYLjwfR6GrqnnbDdVB8Oi4sKJh8Puh6PPzcyAwLovyzAXmjzpk54FMRs7MxdnN9ncAf_VXT6v0mOrN4DiRMrkm2uwoEzojS2ovDSH5RUlaG0k9Rtj9KafqRC4PNqDDG39_Uj93lCt534OfNEtUlJLEqk7nOkLtNK0Jjw&csuir=1 https://www.google.com/search?q=is+google+a+monopoly%3F&udm=...
- saturnite 11mo ago
  Android also has the feature of warning the user if an update is coming from a different source than what is installed. This will happen even if they have the same key. This reply isn't trying to argue against anything you've said. I am just adding to the list of how Android handles updates.
- nandomrumber 11mo ago
  You have to trust somebody. Who is F-Droid? Why should I trust them? How do I know they aren’t infiltrated by TLAs? (Three Letter Agencies), or outright bad-actors. Didn’t F-Droid have 20 or so apps that contained known vulnerabilities back in 2022? Who are all these people? Why should I trust them, and why do most of them have no link to a bio or repository, or otherwise no way to verify they are who they say they are and are doing what they claim to be doing in my best interests? https://f-droid.org/en/about/ https://f-droid.org/en/about/
IshKebab 11mo ago
This is a big problem with Chrome extensions and Google hasn't done anything about it there, so I don't think they actually care about it. I'm not actually sure how you would solve that problem even theoretically.

by leoedin 11mo ago

niutech 11mo ago

In many cases developer e-mail address changes, IP address changes, billing address changes, tax ID changes...

rollcat 11mo ago
This exactly. Transferring ownership is a business transaction. Track that. If the new owner is trying to hide it, this is fraud, and should be dealt with in court.

4u00u 11mo ago

To be fair, on Google Play you have the option to transfer the app to someone else's account. People don't need to trade accounts...

nandomrumber 11mo ago
That doesn’t help mitigate the class of attack you responded to.

lopis 11mo ago

If an app updates to require new permissions, or to suddenly require network access, or the owner contact details change, Google Play should ideally stop that during the update review process and let the users know. But that wouldn't be good for business.

_cenw 11mo ago
This is a huge problem in the Chrome Web Store and Google is doing very little about it. If you ever made an extension that is even just a little popular, expect to get acquisition offers by people who want to add malicious features somewhere between click fraud, residential IP services or even password stealers.
- babuskov 11mo ago
  Same for Play Store. I have 2 games and I keep getting offers all the time. The last one offered $2000 for the developer account or a $100 monthly rent. From their email pitch: > We’re now offering from $500 to $2000 for a one-time purchase of a developer account that includes apps, or a rental deal starting from $100. > No hidden conditions — quick process, secure agreement, and immediate payment upon verification. > We’re simply looking for reliable accounts to publish our client apps quickly, and yours could be a perfect match.
bmacho 11mo ago
Indeed, an update can't be more malicious than the permissions allow it to be. You have a calculator app with limited permissions, it is "safe" to set to allow the developer to update it. No danger in that. But I don't think it is enough, or it is the right model. In other cases, when the app has dangerous permissions already, auto-update should be a no-go.
- cesarb 11mo ago
  > Indeed, an update can't be more malicious than the permissions allow it to be. ...in the absence of sandbox escape bugs.
fauigerzigerk 11mo ago
>...or to suddenly require network access... That's the most baffling thing to me. There is simply no option to remove network permissions from any app on my Pixel phone. It's one of the reasons why I avoid using mobile apps whenever I can.

rixed 11mo ago

> which is widely promoted as being good security practice Maybe that's the mistake right there? It is a good practice only as long as you can trust the remote source for apps. Illustration: it is a good security practice for a Debian distro, not so much for a closed source phone app store.

eMPee584 11mo ago
OPEN SOURCE EVERYTHING is the premier solution.. again.

bmacho 11mo ago

> I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. These are not compatible, but only because the first half is simply false. Allowing a developer to send updates is not "good" but "bad" security practice.

Aissen 11mo ago

By using the distributor model, where a trusted 3rd party builds & distributes the apps. Like every Linux distro or like what F-droid does.

GuB-42 11mo ago

The point here is that app developers have to identify themselves. Google has no intention to verify the content of sideloaded apps, just that it is signed by a real person, for accountability. They don't know if the person who signed the app is the developer, but should the app happen to be a scam and there is a police investigation, that is the person who will have to answer questions, like "who did you transfer these private keys to?". This, according to Google and possibly regulators in countries where this will be implemented, will help combat a certain type of scam. It shouldn't be a problem for YouTube Vanced, at least in the proposed form. The authors, who are already idendified just need to sign their APK. AFAIK, what they are doing is not illegal or they would have been shut down long ago. It may be a problem for others though, and particularly F-Droid, because F-Droid recompiles apps, they can't reasonably be signed by the original author. The F-Droid situation can resolve itself if F-Droid is allowed to sign the apps it publishes, and in fact, doing that is an improvement in security as it can be a guarantee that the APK you got is indeed the one compiled by F-Droid from publicly available source code.

sharperguy 11mo ago
APKs are already signed. Now Google requries that they be signed by a key which is verified by their own signatures. Which means they can selectively refused to verify whichever keys are inconvenient to them.
tcfhgj 11mo ago
> Google has no intention to verify the content of sideloaded apps, just that it is signed by a real person, for accountability. for now
raxxorraxor 11mo ago
Still believe that signing binaries this way is always bullshit. I stopped developing for mobile systems ages ago because it just isn't fun anymore and the devices are vastly more useless. As a user, I don't use apps anymore either. But you can bet I won't ever id myself to Google as a dev.

maybewhenthesun 11mo ago

That's true in theory. But as you can see in practice is that google does very little to protect their users, while F-Droid at least tries. Which shows that the whole 'security' rigmarole by google is bullshit.

mid-kid 11mo ago

> F-Droid couldn't know either F-Droid is not just a repository and an organization providing the relevant services, but a community of like-minded *users* that report on and talk about such issues.

jlokier 11mo ago

> In most cases, F-Droid couldn't know either. F-Droid is quite restrictive about what kinds of app they accept, they build the app from source code themselves, and the source code must be published under a FLOSS license. They have some checks that have to pass for each new version of an app. Although it's possible for a developer to transfer their accounts and private keys to someone shady, F-Droid's checks and open source requirements limit the damage the new developer can do. https://f-droid.org/docs/Inclusion_Policy/ https://f-droid.org/docs/Inclusion_Policy/ https://f-droid.org/docs/Anti-Features/ https://f-droid.org/docs/Anti-Features/

Sophira 11mo ago
One thing worth noting, these checks and restrictions only apply if you're using the original F-Droid repository. Many times I've seen the IzzyOnDroid repository recommended, but that repo explicitly gives you the APKs from the original developers, so you don't get these benefits.
- Zak 11mo ago
  That's true. The whole point of an open ecosystem is that you get to decide who you get your software from. You can decide on the official F-Droid repository and get the benefits and drawbacks of a strict open source rule with the F-Droid organization's curation if that's your preference. You can add other repositories with different curation if you prefer that.
Hizonner 11mo ago
You know what? That's bullshit. Anybody slightly competent can put horrendous back doors into any code, in such a way that they will pass F-Droid's "checks", Apple's "checks", and Google's "checks". Source code is barely a speed bump. Behavioral tests are a joke.
- johnnyanmac 11mo ago
  Anyone determined enough can break into any house. If not through ingenuitiy, then by a brick to your window. Doesn't mean we shouldn't lock our doors, turn off our lights, and close our curtains anyway. The fortunate thing is that 99% of people won't bother trying to break your app if it's not dead simple. Advanved security mechanisms to check for backdoors is probably something only billionaire tech companies need to worry about.

fukka42 11mo ago

Quite simple: Actual human review that works with the developers. But this costs money, and the lack of it is proof google doesn't really care about user security. They're just lying.

bogwog 11mo ago

> In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected. 1. The Android OS does not allow installing app updates if the new APK uses a different signing key than the existing one. It will outright refuse, and this works locally on device. There's no need to ask some third party server to verify anything. It's a fundamental part of how Android security works, and it has been like this since the first Android phone ever release. 2. F-Droid compiles all APKs on its store, and signs them with its own keys. Apps on F-Droid are not signed by the developers of those apps. They're signed by F-Droid, and thus can only be updated through and by F-Droid. F-Droid does not just distribute APKs uploaded by random people, it distributes APKs that F-Droid compiled themselves. So to answer your question, a developer transferring their accounts/keys to someone else doesn't matter. It won't affect the security of F-Droid users, because those keys/accounts aren't used by F-Droid. The worst that can happen is that the new owner tries injecting malware into the source code, but F-Droid builds apps from source and is thus positioned to catch those types of things (which is more than can be said about Google's ability to police Google Play) And finally, > How does Google know if someone has sold off their app? Google should not know anything about the business dealings of potential competitors. Google is a monopoly[1], so there is real risk for developers and their businesses if Google is given access to this kind of information. [1]: https://www.google.com/search?q=is+google+a+monopoly%3F&udm=50&mstk=AUtExfDLG5sfvIlKGBZeuTby2uBqPcLitjLPRlFfqQK1gbWckPsavj74yAa93s9aKsY6Twmk5I3Nxtaw257ul5CvoJZYLjwfR6GrqnnbDdVB8Oi4sKJh8Puh6PPzcyAwLovyzAXmjzpk54FMRs7MxdnN9ncAf_VXT6v0mOrN4DiRMrkm2uwoEzojS2ovDSH5RUlaG0k9Rtj9KafqRC4PNqDDG39_Uj93lCt534OfNEtUlJLEqk7nOkLtNK0Jjw&csuir=1 https://www.google.com/search?q=is+google+a+monopoly%3F&udm=...

saturnite 11mo ago
Android also has the feature of warning the user if an update is coming from a different source than what is installed. This will happen even if they have the same key. This reply isn't trying to argue against anything you've said. I am just adding to the list of how Android handles updates.
nandomrumber 11mo ago
You have to trust somebody. Who is F-Droid? Why should I trust them? How do I know they aren’t infiltrated by TLAs? (Three Letter Agencies), or outright bad-actors. Didn’t F-Droid have 20 or so apps that contained known vulnerabilities back in 2022? Who are all these people? Why should I trust them, and why do most of them have no link to a bio or repository, or otherwise no way to verify they are who they say they are and are doing what they claim to be doing in my best interests? https://f-droid.org/en/about/ https://f-droid.org/en/about/

IshKebab 11mo ago

This is a big problem with Chrome extensions and Google hasn't done anything about it there, so I don't think they actually care about it. I'm not actually sure how you would solve that problem even theoretically.