nodamage

20 ms·

211.
by nodamage 5y ago
I'll modify my wording but that doesn't change the overall point.
212.
by nodamage 5y ago
At this point I am convinced HN commenters have a blind spot when it comes to how easily non-technical users get infected with malware. The latest statistics[1] show iOS has significantly fewer malware infections compared to Android and Win
213.
by nodamage 5y ago
You can also open an iPhone, load any website in Safari, and order whatever you want from the website. Apple can't stop you from doing that either.
214.
by nodamage 5y ago
I don't really see a meaningful difference between those two scenarios. In both cases Google has the ability to exploit your app and you have to trust them not to do it. Whether one approach is more politically acceptable than the othe
215.
by nodamage 5y ago
> If the SDK was backdoored it would show up on everyone's downloads, which greatly increases the chances of detection. I think you have far too much confidence in this. How exactly would the average Android developer check to see
216.
by nodamage 5y ago
> It's less straightforward to backdoor the OS/sdk because it's open source and built by various vendors. Not for devices running Google Play Services. If your device is running AOSP with absolutely zero Google services
217.
by nodamage 5y ago
Verifying that the build came from the developer tells you nothing about whether the app has been backdoored when your adversary controls the compiler used to build the app and the operating system used to execute the app. Reflections on T
218.
by nodamage 5y ago
At this point I am convinced this entire line of thought is just FUD. > This means that Google can (or can be forced to) distribute backdoored versions of popular apps to targeted people. The app you are downloading may be different fro
219.
by nodamage 5y ago
The difference is you only need to transfer enough money to your personal bank account to cover your annual expenses. So if you make $500k/year but only spend $100k/year, then the other $400k will continue to grow tax free.
220.
by nodamage 5y ago
Web browsers can be restricted using the iOS parental control system.
221.
by nodamage 5y ago
Except verifying outside of Android tells you nothing about whether the application as installed on an actual device has been tampered with, so you don't really gain any security from this.
222.
by nodamage 5y ago
If the signature does not match that tells you the app was tampered with, but the inverse is not true when your "adversary" controls the compiler, installer, and the operating system itself. Reflections on Trusting Trust ( https
223.
by nodamage 5y ago
> Which would give them ability to alter basically any app on the play store as they deem fit. Google already controls the operating system, the Play Store, and the SDKs you used to develop your app in the first place. If they wanted to
224.
by nodamage 5y ago
> If google wants to claim that a binary they're shipping to users is same the one they received, they don't need my private key to do that. They can make their own signature, with their own key. IIRC this is how it works by de
225.
by nodamage 5y ago
Since Google already controls the Play Store, the Android operating system, and the Android SDKs, they can already do this regardless of how your app is signed.
226.
by nodamage 5y ago
I'm not sure why mindshare is relevant? You might not worry much about your fridge being compromised, but these days smartphones contain a lot of personal data which could be very problematic if compromised. There is even Android malwa
227.
by nodamage 5y ago
Do you really expect the OS to block apps from accessing screen size, locale, fonts, time zone, GPU metrics, accessibility settings, etc. when they actually need these APIs for legitimate purposes? Location and microphone permissions are re
228.
by nodamage 5y ago
I have done mobile development (both iOS and Android) for a long time and am well aware how sandboxing works. You've misunderstood the issue if you think sandboxing sufficiently solves this problem. Let me flip the question, are you aw
229.
by nodamage 5y ago
It's not quite that simple. There are many APIs that are necessary for legitimate purposes that can also be abused. Many of the APIs used for device fingerprinting fall under this category. The contacts APIs are another good example (j
230.
by nodamage 5y ago
> Which is exactly why Apple should open up iOS to other app stores, and in order to keep iOS users secure they should focus on more things like App Tracking and Transparency, not on monopolizing app stores. This is self-contradictory. I
231.
by nodamage 5y ago
I paid for Spotify directly with a credit card on their website and then logged into my existing account inside the app. So, by definition, I wasn't forced to subscribe through Apple. It's true that you're not allowed to a
232.
by nodamage 5y ago
Restricting APIs doesn't solve the problem because there are plenty of APIs that apps need for legitimate purposes but can be abused by bad actors. Many of the APIs used for device fingerprinting would fall under this category.
233.
by nodamage 5y ago
> Where's your data to support this? Multiple mobile/security companies publish annual malware reports, for example here is Nokia's Threat Intelligence Report for 2020 ( https://www.nokia.com/networks/p
234.
by nodamage 5y ago
Of course you can. You're entirely missing the point, which is that without a review process that sets explicit limits for how data can be used, developers will abuse system APIs to violate user privacy.
235.
by nodamage 5y ago
All apps on iOS need to pass App Store review, which means all apps that integrate third-party SDKs need to ensure those SDKs don't violate App Store policies, including policies on fingerprinting. Apple has already started to deny app
236.
by nodamage 5y ago
The difference is the advertising ID can be disabled or reset by the user, and Apple has started blocking apps that use fingerprinting SDKs during app review. ( https://9to5mac.com/2021/04/01/app-store-now-reje
237.
by nodamage 5y ago
It was generated from the CDC data available here: https://gis.cdc.gov/grasp/fluview/mortality.html
238.
by nodamage 5y ago
It's disappointing to see this type of misinformation being spread on HN. All you need to do is look at all-cause mortality in 2020 compared to previous years to easily disprove this: https://i.imgur.com/z9RsQ8e.png
239.
by nodamage 5y ago
There's a difference between sneaking through App Store review and not enforcing anything at all. People still shoplift even though theft is a crime, that's not an argument against having laws.
240.
by nodamage 5y ago
> Androids aren't known to be virus ridden privacy compromising devices. I mean, statistically, they kind of are. From Nokia's Threat Intelligence Report for 2020 ( https://www.nokia.com/networks/portfolio&#

More ›