4 ms·

If they have concerns about the security of their app on some platform, they have the choice to either put "security" into the app, or to trust the platform ven

If they have concerns about the security of their app on some platform, they have the choice to either put "security" into the app, or to trust the platform vendor to provide the security. The correct solution is the first way. Deferring trust to the platform provider is the lazy way. If their APIs are done correctly, they shouldn't be afraid to expose them.

okanat 4mo ago
You're proving the previous commenter's point. VW doesn't want liability. They do not care about "security" just liability. When they leave the "security" to the platform they can blame them in a lawsuit.
- anonymousiam 4mo ago
  Google has a pretty good legal team. Their developer ToS that absolves them of any sort of liability for anything. So this means VW is just being lazy and not seeking legal protection. https://play.google/developer-distribution-agreement.html https://play.google/developer-distribution-agreement.html
  - noisy_boy 4mo ago
    > VW is just being lazy Maybe they rather be lazy and be able to shift blame, even without much legal recourse.
    - rurban 4mo ago
      They don't care about legal recourse. If there's something wrong, they'll just change the laws. That's why they don't care about GrapheneOS users, or any EU regulation which could harm them.
  - klausa 4mo ago
    >Their developer ToS that absolves them of any sort of liability for anything. This is... obviously not true? If you could (somehow) meaningfully damage a car via the app, do you think VW wouldn't be liable because of the Google Play developer ToS?
    - anonymousiam 4mo ago
      My point was that Google would not be liable. VW cannot evade liability from app misbehavior by using Google Play Protect, so why do they do it?
      - lan321 4mo ago
        It will look better for the project lead if there's an issue though. You can say that you enabled everything recommended by Google or w/e, following best practices, and still got pwned instead of arguing that your own security model had a tiny little flaw that no one recognized. And it frees up project hours which can either be the difference between doing the project or not doing it and/or allow you to have other project work billed to this project.
        theK 4mo ago
        That's definitely a thing in the corporate world. It doesn't even have to be the project lead, sometimes it comes via stakeholders, some times its even well meaning devs. It is a difficult balance to strike if you want to "only be reasonably safe" whereas cargo culting all security features might take a bit of time but you now can say "hey we did everything" []: everything may very well not be a thing but people like to pretend it is
nightpool 4mo ago
How else would you build "security" into the app (in the sense of not allowing third-party modifications of it that would open them up to liability), except relying on hardware attestation that the app has not been modified? That attestation necessarily requires the platform provider to be involved.
- plaguuuuuu 4mo ago
  You don't, the app runs on a user-supplied device. They should secure the part that runs on the car and consider the interface between the app and the api to be a user interface.
  - nightpool 4mo ago
    I don't disagree with this, but you're completely contradicting the user I'm replying to. I'm pointing out that the user who says "you should put security into the app" is completely misguided or at the very least perfectly explaining why VW is doing this.
- steelframe 4mo ago
  Volkswagon has no jurisdiction over how I manage my fob, which is the client for the vehicle's unlock and start API. Once you hand a bearer token to me that governs full access to the vehicle, including the accelerator and steering wheel, it's not your job to babysit whether I chose to use it while drunk or hand it over to someone else.
  - Hnedelin 4mo ago
    Except it is their job, that is why certain signals on the car are protected from manipulation. Any attempt to circumvent this and succeeding would require direct action from VW. If they cannot prove that they did everything possible to prevent that, then they are legally liable to the authorities. Same way that banking apps don’t care if you could screw up your account anyway, they will ban rooted phones just to avoid the risk. Because when something happens, what do you think is more likely? That the customer accepts full responsibility for using a rooted device and says that’s on me? Or that they blame the bank for losing all their savings?

okanat 4mo ago

You're proving the previous commenter's point. VW doesn't want liability. They do not care about "security" just liability. When they leave the "security" to the platform they can blame them in a lawsuit.

anonymousiam 4mo ago
Google has a pretty good legal team. Their developer ToS that absolves them of any sort of liability for anything. So this means VW is just being lazy and not seeking legal protection. https://play.google/developer-distribution-agreement.html https://play.google/developer-distribution-agreement.html
- noisy_boy 4mo ago
  > VW is just being lazy Maybe they rather be lazy and be able to shift blame, even without much legal recourse.
  - rurban 4mo ago
    They don't care about legal recourse. If there's something wrong, they'll just change the laws. That's why they don't care about GrapheneOS users, or any EU regulation which could harm them.
- klausa 4mo ago
  >Their developer ToS that absolves them of any sort of liability for anything. This is... obviously not true? If you could (somehow) meaningfully damage a car via the app, do you think VW wouldn't be liable because of the Google Play developer ToS?
  - anonymousiam 4mo ago
    My point was that Google would not be liable. VW cannot evade liability from app misbehavior by using Google Play Protect, so why do they do it?
    - lan321 4mo ago
      It will look better for the project lead if there's an issue though. You can say that you enabled everything recommended by Google or w/e, following best practices, and still got pwned instead of arguing that your own security model had a tiny little flaw that no one recognized. And it frees up project hours which can either be the difference between doing the project or not doing it and/or allow you to have other project work billed to this project.
      - theK 4mo ago
        That's definitely a thing in the corporate world. It doesn't even have to be the project lead, sometimes it comes via stakeholders, some times its even well meaning devs. It is a difficult balance to strike if you want to "only be reasonably safe" whereas cargo culting all security features might take a bit of time but you now can say "hey we did everything" []: everything may very well not be a thing but people like to pretend it is

nightpool 4mo ago

How else would you build "security" into the app (in the sense of not allowing third-party modifications of it that would open them up to liability), except relying on hardware attestation that the app has not been modified? That attestation necessarily requires the platform provider to be involved.

plaguuuuuu 4mo ago
You don't, the app runs on a user-supplied device. They should secure the part that runs on the car and consider the interface between the app and the api to be a user interface.
- nightpool 4mo ago
  I don't disagree with this, but you're completely contradicting the user I'm replying to. I'm pointing out that the user who says "you should put security into the app" is completely misguided or at the very least perfectly explaining why VW is doing this.
steelframe 4mo ago
Volkswagon has no jurisdiction over how I manage my fob, which is the client for the vehicle's unlock and start API. Once you hand a bearer token to me that governs full access to the vehicle, including the accelerator and steering wheel, it's not your job to babysit whether I chose to use it while drunk or hand it over to someone else.
- Hnedelin 4mo ago
  Except it is their job, that is why certain signals on the car are protected from manipulation. Any attempt to circumvent this and succeeding would require direct action from VW. If they cannot prove that they did everything possible to prevent that, then they are legally liable to the authorities. Same way that banking apps don’t care if you could screw up your account anyway, they will ban rooted phones just to avoid the risk. Because when something happens, what do you think is more likely? That the customer accepts full responsibility for using a rooted device and says that’s on me? Or that they blame the bank for losing all their savings?