4 ms·

Android allows apps to install apps (how the amazon store works) and if the new app appears signed with the device vendor's key then I'm guessing it wouldn't be

• atesti 13y ago
  Which apps can do this? Is this a special right (installing apps)? Or is it always granted? Does this mean that if I don't install any rogue app store, that I'm safe against the attack which allows forging signatures?
  • gohrt 13y ago
    android.permission.INSTALL_PACKAGES
  • andrewaylett 13y ago
    My understanding is that only apps that are present in some form in flash (even if subsequently updated) are allowed to install without the device asking the user explicitly for confirmation. Compare the process with the Play store (store app prompts before download, can install from the web without prompt) with that of the Amazon store on non-Amazon devices (device prompts after download). android.permission.INSTALL_PACKAGES controls which of the in-flash applications may install stuff: it's not available to non-built-in applications at all, and the Amazon store doesn't have (or need) it.