5 ms·

Yes. wfwalker said it best here: https://hacks.mozilla.org/2014/06/testing-your-native-android-app/comment-page-1/#comment-2162370 https://hacks.mozilla.org/201

by ozten 12y ago

Yes. wfwalker said it best here: https://hacks.mozilla.org/2014/06/testing-your-native-android-app/comment-page-1/#comment-2162370 https://hacks.mozilla.org/2014/06/testing-your-native-androi... "We share your frustration with the tradeoffs we have to make on Android regarding security versus openness, as I’m sure Amazon does as well. For example, it would be cool if we could ask people to trust apps they install from marketplace.firefox.com rather than from all sources. Unfortunately, I don’t think we have that option. We, along with third-party native android app stores like Amazon, chosen to ask users to enable the third-party application setting because we think the benefits to users of our ecosystem outweigh the risks of doing so. We believe our security model and strict control over permissions for web apps means that the Firefox Marketplace apps that users install on their Android devices will be safe."

Pxtl 12y ago
I've been wondering - is there any app that makes this process more elegant, like controlling which users can install 3rd-party APKs or something?
mhurron 12y ago
I will start with I see this weren't your words. "it would be cool if we could ask people to trust apps they install from marketplace.firefox.com rather than from all sources." This would be so handy for me, but it probably doesn't matter as my next phone is probably going to be an iPhone. However, "We believe our security model and strict control over permissions for web apps means that the Firefox Marketplace apps that users install on their Android devices will be safe" basically misses the problem. The problem is not that the Mozilla or Amazon marketplaces are unsafe, I would rate them at the same as Google Play itself, but that the phone now allows APK's from everywhere. While it would turn more users away from using them, it would almost be better to actually tell people to re-enable the restrictions, or have an install app that will turn it on, install from their marketplace and then turn it off again.
st3fan 12y ago
I really wish Mozilla had just abandoned this 'repackage apps in APKs' project. I understand why they are doing it but I think in the end it is really bad for end-user security on Android. People are advised everywhere to not enable 'Install from untrusted sources' for very good reasons: Android is plagued by an insane amount of malware. And now we confuse them by saying that "our security model" is great and that it is all ok. But it is not ok. It is half the story. Even if our apps are safe, we make it a little easier for that malware to get on a device. And nobody will just temporarily enable 'install from untrusted sources'. Once allowed, people are most likely never looking at it again. I am not saying that the Google Play store is free of Malware. It is not. But I do think that malicious apps are then at least contained and controlled. With the option for untrusted sources enabled, apps can come from any place. Email, web, other apps, etc. It puts users at risk. It is a step backward in Android security.
- zobzu 12y ago
  Everyone I know (hint: they're in the bay area and even if not all techies, they kinda know a bit computer stuff) disable that option (forever, indeed) and installs APKs from their favorite non-Google-Play source. I'm pretty sure they added this option as an enforcement to use only Play. I would be surprised to see Google adding trusted sources. I do not believe that it's OK to kill competition in the name of so-called security. On the other hand my mum doesnt know that option yet got Play malware pretty quickly. Go figure. Think of the Children! :)
  - Nursie 12y ago
    I know nobody that would uncheck the option unless they were very sure of the source, and then turn it back off again. I've been to websites that automatically trigger the download of an apk to your phone. Without that setting it is only one or two wrong clicks and you've got all sorts of malware on your device. It's not about competition, running a phone with that option switched off is dangerous.
    - 1stop 12y ago
      Automatically triggering an apk download is just that... a download. An install (from opening said apk) triggers a fullscreen dialog of what you are installing, it's access, and whether you are sure...? It isn't dangerous at all, you can't 'accidently' install an apk. It is a very intentional, multi-step, action.

by ozten 12y ago

Pxtl 12y ago

I've been wondering - is there any app that makes this process more elegant, like controlling which users can install 3rd-party APKs or something?

mhurron 12y ago

I will start with I see this weren't your words. "it would be cool if we could ask people to trust apps they install from marketplace.firefox.com rather than from all sources." This would be so handy for me, but it probably doesn't matter as my next phone is probably going to be an iPhone. However, "We believe our security model and strict control over permissions for web apps means that the Firefox Marketplace apps that users install on their Android devices will be safe" basically misses the problem. The problem is not that the Mozilla or Amazon marketplaces are unsafe, I would rate them at the same as Google Play itself, but that the phone now allows APK's from everywhere. While it would turn more users away from using them, it would almost be better to actually tell people to re-enable the restrictions, or have an install app that will turn it on, install from their marketplace and then turn it off again.

st3fan 12y ago

I really wish Mozilla had just abandoned this 'repackage apps in APKs' project. I understand why they are doing it but I think in the end it is really bad for end-user security on Android. People are advised everywhere to not enable 'Install from untrusted sources' for very good reasons: Android is plagued by an insane amount of malware. And now we confuse them by saying that "our security model" is great and that it is all ok. But it is not ok. It is half the story. Even if our apps are safe, we make it a little easier for that malware to get on a device. And nobody will just temporarily enable 'install from untrusted sources'. Once allowed, people are most likely never looking at it again. I am not saying that the Google Play store is free of Malware. It is not. But I do think that malicious apps are then at least contained and controlled. With the option for untrusted sources enabled, apps can come from any place. Email, web, other apps, etc. It puts users at risk. It is a step backward in Android security.

zobzu 12y ago
Everyone I know (hint: they're in the bay area and even if not all techies, they kinda know a bit computer stuff) disable that option (forever, indeed) and installs APKs from their favorite non-Google-Play source. I'm pretty sure they added this option as an enforcement to use only Play. I would be surprised to see Google adding trusted sources. I do not believe that it's OK to kill competition in the name of so-called security. On the other hand my mum doesnt know that option yet got Play malware pretty quickly. Go figure. Think of the Children! :)
- Nursie 12y ago
  I know nobody that would uncheck the option unless they were very sure of the source, and then turn it back off again. I've been to websites that automatically trigger the download of an apk to your phone. Without that setting it is only one or two wrong clicks and you've got all sorts of malware on your device. It's not about competition, running a phone with that option switched off is dangerous.
  - 1stop 12y ago
    Automatically triggering an apk download is just that... a download. An install (from opening said apk) triggers a fullscreen dialog of what you are installing, it's access, and whether you are sure...? It isn't dangerous at all, you can't 'accidently' install an apk. It is a very intentional, multi-step, action.