I'm glad that Firefox on Android now has a built-in QR code scanner. This is the best UI and security improvement they added in the last 5 years.
[deleted]
Barcode scanner app on Google Play infects 10M users with one update
191–200 of 465 posts
Re: Barcode scanner app on Google Play infects 10M users with one update
#192I stick to F-droid android app store. it asks developer to submit their code which gets compiled by the F-Droid team. apps with proprietary codes are flagged. few QR code apps from F-Droid. https://f-droid.org/en/packages/com.example.barcodescanner/ https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...
Open source apps can absolutely have trackers in them. F-Droid isn't a security solution by any measure. I have inspected code of at least one popular "privacy" app that absolutely tracks its users out in the open (I mean, the code is right there on GitHub), yet I see repeatedly that app (and F-Droid) being touted as some elixir that fixes security and privacy for one and all. It doesn't. Don't place your trust on F-…
It would be more compelling if you actually mentioned what app you've found that's so naughty.
Re: Barcode scanner app on Google Play infects 10M users with one update
#193Earlier quoted context omitted.
yeah this is one reason why I can't take mobile app end to end encryption, or client side only, claims seriously. a single update at any time could undermine all of that and secondly, they or an analytics package can just read everything client side and upload it to a server anyway doesn't matter if its whatsapp, or signal, or some protonmail client if such a thing exists I just don't use them with that assurance in…
>yeah this is one reason why I can't take mobile app end to end encryption, or client side only, claims seriously. If it's a large company like Facebook that values these products like Whatsapp at billions I trust them at least on this issue. I'm pretty sure they're not going to put junk third party malware for 50k into the Whatsapp client. This is mostly an issue for apps done by individual developers who have huge…
> I trust them
You literally mentioned a company that betrayed trust so bad a government tried to call them to account.
Re: Barcode scanner app on Google Play infects 10M users with one update
#194Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…
Most apps never need to be updated, problem solved. Especially stuff like barcode scanners, authenticator apps and other apps that I'd call phone infrastructure can just be static from the time of install.
And then the app isn't working anymore due to newer os breaking change
Or it suddenly gone from app / play store
Re: Barcode scanner app on Google Play infects 10M users with one update
#195Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…
I think you are absolutely right about how easy it is to fall prey to lots of money for adding a simple payload.
In the early days Wordpress sold use of their domain to black hat seo / spammers.
Re: Barcode scanner app on Google Play infects 10M users with one update
#196Earlier quoted context omitted.
He is right in a sense, and cases like this give him proof, but on the other hand, most people don't see the point in patching their software. They'd just keep it around unpatched, while connecting it to the network. Is millions of vulnerable devices better than giving vendors of some software the ability to remotely patch their software?
And even when you choose to only manually upgrade, carefully looking at the changelog, but it just says "Bugs fixed." The Play Store doesn't give enough information to really judge if the upgrade is necessary.
"Bug fixes and performance improvements". ~AirBnB
Re: Barcode scanner app on Google Play infects 10M users with one update
#197The only reason this was detected was very overt behavior - opening AD popups. So I guesstimate for each one of these we have 10 that go undetected. This means the whole ecosystem is broken, as there is no reason this will happen only for updates and not for new apps as well. Apple's ecosystem is somewhat better, but I can't imagine they go through every line of code in each package, so most of their review is probab…
This happened on ios for me years ago. I had two apps that radically changed their business model (owner?) through updates with no recourse. I had an app called gas cubby, which let me locally - on the phone - keep track of all my vehicles. I could enter detailed information about each car such as year, make, model, vin, insurance policy, gas purchases, oil changes and the like. It would tell you gas mileage and remi…
> One day, I updated the app and all my local data was uploaded to the cloud
This happened to me with Chrome. It auto-updated, then automatically synced browser history, passwords, and who knows what else, to Google. They soon changed it to opt-in sync, but it was too late for me at that point; they had already hoovered up my personal data. That was when I stopped using Chrome and switched fully to Firefox.
Re: Barcode scanner app on Google Play infects 10M users with one update
#198Earlier quoted context omitted.
Maybe I'm a luddite but updates are not always necessary. It's a barcode app, what updates does it need? Is there a cve that needs to be patched? No? Then I don't need a new version
I’m usually like this. Then my bank’s app refused to launch until I updated. They re-designed it. When I went to click my usual “schedule payment” button on a bill payment, it just said “Coming Soon”. I wasn’t a happy person about it. Big Canadian bank too. US$65b mkt cap.
Generally the apk can be decompiled and the protections stripped if it really bothers you to update.
Re: Barcode scanner app on Google Play infects 10M users with one update
#199Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…
> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…
> To make matters worse, scanning a barcode when you enter a store/cafe (to register your location), is now begin done everywhere in order to track potential covid19 spreaders. This forces anyone without an iPhone to install at least one of these potentially harmful apps.
Our (New Zealand) Covid tracing app scans QR codes itself. What jurisdictions are requiring to scan an arbitrary QR code using random apps?
https://www.health.govt.nz/our-work/diseases-and-conditions/...
Re: Barcode scanner app on Google Play infects 10M users with one update
#200I use this one from F-Droid:
https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...
you can directly download the APK from that site, don't need an F-Droid client.
If you want an F-Droid client, i recommend Foxy Droid. Unfortunately lacks some features of the official one but way faster and nicer to use.