> All apps I installed on my phone came from a server and were put there by people I don't know at all. The apps on your phone can't be updated without notice

> All apps I installed on my phone came from a server and were put there by people I don't know at all. The apps on your phone can't be updated without notice to you. It's significantly more difficult for the app developer to maliciously update only your copy, and not every copy. Updating everyone's copy has higher much risk. > Is it that browser apps get "reinstalled" on every use, and not "only" when an autoupdater or user detects a new version? Yes. You might not be able to reverse engineer the Dropbox client, but you can download it from several places and see if it's the same. If I'm a developer who releases some software version 1.2.3 with a trojan in it, I can't easily take it back, making the risk of detection significant. You have stuff like the NIST NSRL out there compiling databases of hashes of all the software they can get their hands on. You have security researchers reverse engineering patches looking for silently fixed vulnerabilities. With a web page it's really easy to serve the trojan once to a specific user. The risk is very low. Hushmail did it, for example. The fact that operating system vendors have the power to trojan us at will is a huge problem. And thanks to online activation many users are easily identified for targeting. I don't think many people want to talk about it because it's so difficult to fix.