Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Play has been spreading advanced Android malware for years

arstechnica.com

Post reply on HN
Print view View original

91–100 of 127 posts

Re: Google Play has been spreading advanced Android malware for years

#91

Post by peterwwillis »

AnthonyMouse wrote: post #7

Let this be another nail in the coffin of the "walled garden" farce. We learn this lesson again and again. People want someone to trust, but a bureaucracy isn't trustworthy. It has its own agenda and values inconsistent with yours. They take 30% from everybody whether they approve malware or not, and whether they reject legitimate apps or not. Trust doesn't come from size. If you want someone to vet your apps, it has…

Nobody has yet said the words "lock-in device". Everybody moans about lock-in devices when it's convenient for them, but then they throw away the ability to use anything else by committing full-tilt to these mobile platforms where to install "unapproved" apps you have to literally hack your own device.

Apple and Google got rich doing what we would have lambasted Microsoft for, because our judgement is clouded by brands.

Re: Google Play has been spreading advanced Android malware for years

#92

Post by Dragory »

Razengan wrote: post #8
AnthonyMouse wrote: post #7

Let this be another nail in the coffin of the "walled garden" farce. We learn this lesson again and again. People want someone to trust, but a bureaucracy isn't trustworthy. It has its own agenda and values inconsistent with yours. They take 30% from everybody whether they approve malware or not, and whether they reject legitimate apps or not. Trust doesn't come from size. If you want someone to vet your apps, it has…

I would still prefer to have to trust just one authority for my platform than a multitude of random developers. > Let this be another nail in the coffin of the "walled garden" farce. There is no coffin, the walled gardens are not dying, and have long since become the norm, which happened because the people found them to be better than the alternative: getting apps (and manually updating them) from many different sour…

> I would still prefer to have to trust just one authority for my platform than a multitude of random developers.

These are not the only two options. What about multiple authorities, but not random individual developers? That's basically how it works with e.g. game stores on PC (though Steam is certainly the largest), or package repositories on Linux.

Like you, I like being able to trust an authority to vet the software I install rather than having to judge the trustworthiness of each individual developer, but I'm not a fan of there only being one authority by design (as it is on e.g. iOS). It introduces a single point of failure and gives that authority full control over all software on that platform - for better or worse. Many package managers specifically deal with the issue of consolidating updates to a single system while not relying on a single authority.

Re: Google Play has been spreading advanced Android malware for years

#93

Post by fao_ »

Dragory wrote: post #92
Razengan wrote: post #8

Earlier quoted context omitted.

I would still prefer to have to trust just one authority for my platform than a multitude of random developers. > Let this be another nail in the coffin of the "walled garden" farce. There is no coffin, the walled gardens are not dying, and have long since become the norm, which happened because the people found them to be better than the alternative: getting apps (and manually updating them) from many different sour…

> I would still prefer to have to trust just one authority for my platform than a multitude of random developers. These are not the only two options. What about multiple authorities, but not random individual developers? That's basically how it works with e.g. game stores on PC (though Steam is certainly the largest), or package repositories on Linux. Like you, I like being able to trust an authority to vet the softw…

> What about multiple authorities, but not random individual developers? That's basically how it works with e.g. game stores on PC (though Steam is certainly the largest), or package repositories on Linux.

> Like you, I like being able to trust an authority to vet the software I install rather than having to judge the trustworthiness of each individual developer, but I'm not a fan of there only being one authority by design (as it is on e.g. iOS).

You can already do this on Android though. Samsung offers an individual app store for it's phones, and FDroid works on all phones.

Re: Google Play has been spreading advanced Android malware for years

#94

Post by lern_too_spel »

dTal wrote: post #33
lern_too_spel wrote: post #18

Earlier quoted context omitted.

On the contrary, Apple has served malware to far more users than Google despite having far fewer total users. https://blog.lookout.com/xcodeghost-apps Apple also uses your GPS data to update its location service (for profit), and unlike Android offers no way to opt out — if you want to get your location on an iDevice, Apple will get it, too. If you want to do something crazy like write apps for your own device withou…

>unlike Android offers no way to opt out — if you want to get your location on an iDevice, Apple will get it, too. As far as I know there is not a way to opt out of this in (Googlified) Android. If you have Play Services installed (which you do, unless you've taken unreasonable steps to avoid it such as rooting and installing a 3rd party ROM), you get a dialog box popup whenever you enable location services which inf…

> And you need location services even to use the GPS.

This is the part that's wrong. Unlike on iOS, you can use the location API directly on Android without Location Services enabled, and the Location Services get location updates API will fall back to using that if Location Services is disabled.

https://developer.android.com/reference/android/location/pac...

https://support.google.com/accounts/answer/3467281?hl=en

Re: Google Play has been spreading advanced Android malware for years

#95

Post by _bxg1 »

AnthonyMouse wrote: post #7

Let this be another nail in the coffin of the "walled garden" farce. We learn this lesson again and again. People want someone to trust, but a bureaucracy isn't trustworthy. It has its own agenda and values inconsistent with yours. They take 30% from everybody whether they approve malware or not, and whether they reject legitimate apps or not. Trust doesn't come from size. If you want someone to vet your apps, it has…

And yet Apple's walled garden is stronger and hasn't had anywhere near the malware problem that Google's has? I don't understand your point.

Privacy is where these companies' interests might not be aligned with users; when it comes to security, they very much are. It's just that for Google that's limited to their own services; they don't care so much when it comes to Android as a broader platform. But even then their interests are not not aligned with users. Just under-incentivized.

Re: Google Play has been spreading advanced Android malware for years

#96

Post by [deleted] »

scarface74 wrote: post #31
realusername wrote: post #29

Earlier quoted context omitted.

I separate their concept of the sandbox (app permissions) from the walled garden (the App Store & the lockdown of user install). You can totally have a sandbox without a walled garden. It seems that in this case, the walled garden did not help in any ways.

This is all the apps could do. The malware removes information off the device like the device’s name, country, and unique identifiers. This part is complete conjecture. According to Palo Alto Networks, it may also have the ability to push dialogue boxes to your iPhone or iPad’s screen. Theoretically, a bad guy could use one of these dialogues to steal your username and password or other personal information. The malw…

[deleted]

Re: Google Play has been spreading advanced Android malware for years

#97

Post by Razengan »

Dragory wrote: post #92
Razengan wrote: post #8

Earlier quoted context omitted.

I would still prefer to have to trust just one authority for my platform than a multitude of random developers. > Let this be another nail in the coffin of the "walled garden" farce. There is no coffin, the walled gardens are not dying, and have long since become the norm, which happened because the people found them to be better than the alternative: getting apps (and manually updating them) from many different sour…

> I would still prefer to have to trust just one authority for my platform than a multitude of random developers. These are not the only two options. What about multiple authorities, but not random individual developers? That's basically how it works with e.g. game stores on PC (though Steam is certainly the largest), or package repositories on Linux. Like you, I like being able to trust an authority to vet the softw…

When it comes to the system's core sandboxing mechanism, only one authority can sign the certificates and provision capabilities etc.

If multiple authorities can sign apps, it sort of defeats the point and makes the sandboxing less trustworthy.

Right now, I can either: Rest assured that an app is sandboxed (via the App Store or macOS Notarization) or choose to let it run anyway (on macOS.) A dev could notarize their game (or not) and distribute it through Steam or the App Store, or both.

If Steam and GoG etc. could sign apps, then you're back to having multiple authorities of varying trustworthiness.

Re: Google Play has been spreading advanced Android malware for years

#98

Post by lern_too_spel »

anhner wrote: post #87
sneak wrote: post #68

Earlier quoted context omitted.

Yes, but the permission is per-app. Let’s say I approve location for the app because the app’s function requires it: the third party spying SDKs embedded in the app send that location data off to third parties without notifying me or permitting me to stop it. Apple permits this behavior in the App Store. Furthermore, IP address is coarse location even if you don’t grant the app permission, via GeoIP databases. Long s…

If an app's function requires location, how is it Apple's fault that the user decides it's better to enable that app to spy on him? If I use Waze do I expect privacy from it when it's essential that it knows my location? Furthermore, on iPhone you get a warning when an app abuses the location permission, unlike Android. At least on iPhones you have per app control, on Android it's either "location on" or "location of…

> At least on iPhones you have per app control, on Android it's either "location on" or "location off"

Where did you get that notion? Location permission has been per-app since before Android launched. Even better, you can get your location without telling Google, unlike on iOS, which always tells Apple.

> Furthermore, on iPhone you get a warning when an app abuses the location permission, unlike Android.

If you're talking about https://www.cpomagazine.com/data-privacy/apples-new-ios-13-w..., this warning just covers a bug in iOS. Android already requires the app to request location permission to use any API that will allow the location to be inferred (e.g., Bluetooth and WiFi scanning). Therefore, no such warning is required on Android. The app already had to explicitly request location permission.

Re: Google Play has been spreading advanced Android malware for years

#99

Post by Razengan »

ycombi3 wrote: post #53
realusername wrote: post #24

Earlier quoted context omitted.

> which happened because the people found them to be better than the alternative Walled garden only exists because mobile devices make self-install alternatives very difficult or impossible to get on purpose, otherwise they would not be able to compete in any ways. Case in point, the Mac App Store and the Windows Store are both moderate failures despite a lot of technical & marketing push.

I'd say that they are more than moderate failures. I've heard from many acquaintances who aren't as tech literate as myself that one of the major reasons they got rid of their iPhone was not being able to install applications from outside sources. Myself, I would never want to trust anything centralized.

> Myself, I would never want to trust anything centralized.

How is that different from trusting multiple sources? You'd just be multiplying your concerns. Any of them could slip in some malware.

The only advantage I can think of is censorship resistance, or access to older versions and discontinued products.

Re: Google Play has been spreading advanced Android malware for years

#100

Post by BenjiWiebe »

dathinab wrote: post #66
literallycancer wrote: post #56

Earlier quoted context omitted.

If you don't like Google, installing a community ROM that doesn't violate your privacy would be perfectly reasonable. If you want a megacorp service but not from a megacorp, I think you won't find that anywhere.

But then all banking apps stop working (including the 2FA apps "required" for using credit cards from some EU Banks; for EC cards you luckily still can use ChipTAN). Also mobile payment will stop working, normally I wouldn't care about that but currently paying without touching anything is nice. Then some apps you need for work might stop working. Not even speaking about hounded of other apps. The problem is to many…

Not true. With things like magisk and systemless root, the banking apps continue to work. At least my 4-5 banking/payment/credit card apps all work, with lineageos and magisk.
Post reply on HN