4 ms·
I really wish Mozilla had just abandoned this 'repackage apps in APKs' project. I understand why they are doing it but I think in the end it is really bad for
by st3fan 12y ago
I really wish Mozilla had just abandoned this 'repackage apps in APKs' project.
I understand why they are doing it but I think in the end it is really bad for end-user security on Android.
People are advised everywhere to not enable 'Install from untrusted sources' for very good reasons: Android is plagued by an insane amount of malware. And now we confuse them by saying that "our security model" is great and that it is all ok.
But it is not ok. It is half the story. Even if our apps are safe, we make it a little easier for that malware to get on a device.
And nobody will just temporarily enable 'install from untrusted sources'. Once allowed, people are most likely never looking at it again.
I am not saying that the Google Play store is free of Malware. It is not. But I do think that malicious apps are then at least contained and controlled. With the option for untrusted sources enabled, apps can come from any place. Email, web, other apps, etc.
It puts users at risk.
It is a step backward in Android security.
- zobzu 12y agoEveryone I know (hint: they're in the bay area and even if not all techies, they kinda know a bit computer stuff) disable that option (forever, indeed) and installs APKs from their favorite non-Google-Play source. I'm pretty sure they added this option as an enforcement to use only Play. I would be surprised to see Google adding trusted sources. I do not believe that it's OK to kill competition in the name of so-called security. On the other hand my mum doesnt know that option yet got Play malware pretty quickly. Go figure. Think of the Children! :)
- Nursie 12y agoI know nobody that would uncheck the option unless they were very sure of the source, and then turn it back off again. I've been to websites that automatically trigger the download of an apk to your phone. Without that setting it is only one or two wrong clicks and you've got all sorts of malware on your device. It's not about competition, running a phone with that option switched off is dangerous.
- 1stop 12y agoAutomatically triggering an apk download is just that... a download. An install (from opening said apk) triggers a fullscreen dialog of what you are installing, it's access, and whether you are sure...? It isn't dangerous at all, you can't 'accidently' install an apk. It is a very intentional, multi-step, action.
- Nursie 12y agoOf course you could. You (an uninformed user, not a hacker) go to see what the notification you just got is about and tap on it. It's then only one more click to install. Much easier and safer to have third party stuff disabled entirely. I think there should be a way to install third party certificates for things like the amazon store, don't get me wrong, but it's a decent security feature for the uninformed masses.
- 1stop 12y agoBut you aren't an 'uninformed user' you've gone to the app section of settings and intentionally clicked "I want to install third party apps" and then intentionally clicked "Yes, I know this isn't a great idea". So chances are, on the spectrum you are more hacker than uninformed user.
- Nursie 12y agoAndroi is not just aimed at me though, extra protection for the uninformed is not a bad thing. IMHO.
- SteveMoody73 12y agoIt's been a while since i've installed from unknown sources but doesn't it give a prompt asking if you want the apk scanned for malicious apps?
- Nursie 12y agoI've never seen such a prompt when install third party stuff, no. There might be an 'are you sure?' dialog.