51–60 of 65 posts
I'm not sure I'm a fan of the way Google is re-using the Chrome error page styling for this, but I can't put my finger on why exactly...
In case you don't feel like clicking, this doesn't concern Android apps, but OAuth apps that want access to your Google account.
It's also worth noting that this likely would stop phishing attacks like the one that happened earlier this year. https://www.theverge.com/2017/5/3/15534768/google-docs-phish... https://news.ycombinator.com/item?id=14258918
It allows an attack to present a user with a real Google 'account select' page with their account listed, but if they click that link it actually redirects them to another site (which you can dress up to look like the password page the user is expecting).
It is arguably worse than the previous issue, as I don't need a hoax extension, I can just manipulate the link to inject the malicious redirect behaviour.
They have triaged it and I'll probably write up a report once they are happy for me to do so.
In case you don't feel like clicking, this doesn't concern Android apps, but OAuth apps that want access to your Google account.
It's also worth noting that this likely would stop phishing attacks like the one that happened earlier this year. https://www.theverge.com/2017/5/3/15534768/google-docs-phish... https://news.ycombinator.com/item?id=14258918
I just can't shrug off the thought that manual review approach is a lost game in the long run. It's a process than requires skilled human and can't be fully automated while generating malicious code perfectly can.
AI and machine learning are most effective these days when they help assist people (flagging potentially malicious code, bubbling up anomalies, etc.), and it isn't that expensive to get a pair of eyeballs to double check conclusions!
Earlier quoted context omitted.
But making legit apps does take human effort. If an app takes days to make, requiring 5 minutes extra review effort to get it whitelisted seems fine.
Only if similar numbers of people work on each side. With thousands or millions of developers to a handful of reviewers, it may go as well as Google's other attempts at human support (read: terrible).
A non-prohibitive barrier to entry wouldn't be a big issue, as users in general want stricter filters that mean less shitty apps instead of looser filters that mean simply more apps.
I just can't shrug off the thought that manual review approach is a lost game in the long run. It's a process than requires skilled human and can't be fully automated while generating malicious code perfectly can.
Tasks of classifying things (in this case into "approved" or "rejected") that humans can routinely do but machines find difficult are areas where ML shines. Human reviewers today, but once the training set is large enough you can start to let computers take over with human reviewers reviewing the lower certainty cases until the certainties rise further.
Earlier quoted context omitted.
I was wondering how HN would spin this into Evil-Google. It's just tiring at this point. This is a perfectly valid security guard that protects their users.
> This is a perfectly valid security guard that protects their users No it's not. It's Google telling it's users which apps to use and not to use. For regular users Google presents itself (just like Apple does) as an authority of what's a good app. Any other apps automatically are not good in the mind of regular users.
> No it's not. It's Google telling it's users which apps to use and
> not to use. For regular users Google presents itself (just like Apple does)
> as an authority of what's a good app.
The validation process does not look onerous:
https://support.google.com/code/contact/oauth_app_verificati...
It's an extra step, and therefore probably frustrating to a number of people - but I have a hard time seeing how taking a few minutes to declare your intentions around private data usage with the entity supplying that data for your use is a bad thing. I hope other OAuth providers go in a similar direction - that way developers don't just go with "easier" paths that are less secure for their users.
User types "continue"
Earlier quoted context omitted.
Or "I allow LeetHaxorApp to access all my data" But I guess that is a bit too much typing for most people.
Might be a good thing for apps that try and looking like something else, G00GLE or FACEB00K could be missed, but having to type a zero manually instead of an O would (hopefully) eliminate that.
I would have thought by now it would be pretty easy for algorithms or AI to pick up on these kinds of tricks, whether by a similarity score or an image processing approach.