Google I/O 2021 and Uncomfortable Questions • Hacker News Board

Re: Google I/O 2021 and Uncomfortable Questions

#21

Post by nodamage » Sun, May 02, 2021, 1:20 AM UTC

_hyn3 wrote: post #3

tldr: Google's new app bundle signing might be a precursor (well, almost certainly is) to Google's being able to replace parts of and modify your app on the fly when installed by certain targeted users or within certain targeted countries at Google's whim, with users being none the wiser. Google might do this for a lot of reasons, and none of them seem to be good. FWIW, Google promises not to change the functionality…

Since Google already controls the Play Store, the Android operating system, and the Android SDKs, they can already do this regardless of how your app is signed.

Re: Google I/O 2021 and Uncomfortable Questions

#22

Post by detaro » Sun, May 02, 2021, 1:21 AM UTC

teraflop wrote: post #12

pmoriarty wrote: post #5

Earlier quoted context omitted.

Wouldn't a simple solution to this be a double signing of one and the same app by both Google and the app's author? That way, if Google changes the app and signs it, while the author only signed the unchanged app, then the author's signature would no longer validate on the new, changed app. Or am I missing something?

The whole point of this feature is to allow Google to modify the APK by stripping out unneeded resources to reduce file size. If you require both a signature from Google and a signature from the developer, the modified versions would not pass validation. The issue is that this inherently requires users and developers to trust Google to only make innocuous changes.

If it's just "sign a thing, but allow some parts to be crossed out later while still being able to verify the signature", that's not that difficult to implement.

Re: Google I/O 2021 and Uncomfortable Questions

#23

Post by soarfourmore » Sun, May 02, 2021, 1:23 AM UTC

josephg wrote: post #20

est31 wrote: post #6

App bundles allow smaller apk sizes [0]: > Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads. But as all this logic s…

Piling on here, thats super weird . The reason for digital signatures is that they make a claim. "As a representative of organisation A, the binary with shasum XXXX is our work. We stand behind it." Why would I generate a private key, then share my private key with google ? If google wants to claim that a binary they're shipping to users is same the one they received, they don't need my private key to do that. They c…

It’s even weirder that Google’s security engineers would sign off on such a design. I am astounded

Re: Google I/O 2021 and Uncomfortable Questions

#24

Post by remram » Sun, May 02, 2021, 1:24 AM UTC

est31 wrote: post #6

App bundles allow smaller apk sizes [0]: > Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads. But as all this logic s…

It's just a little bit weird that Google designed the Play Store and Android with key signing if they then have to ask for those keys. They control the OS and the store, couldn't they just make devices trust Google's app-repackaging-service's key? This would be easier for everyone, and more honest for the consumer user who gets packages signed by whoever actually built it.

Re: Google I/O 2021 and Uncomfortable Questions

#25

Post by a-dub » Sun, May 02, 2021, 1:24 AM UTC

est31 wrote: post #6

App bundles allow smaller apk sizes [0]: > Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads. But as all this logic s…

it doesn't matter, they could just push an android update that bypasses your signature if they really wanted to. granted that's a bigger deal, but they control the ecosystem in google play and hold the signing keys for android and google play itself, you already trust them.

Re: Google I/O 2021 and Uncomfortable Questions

#26

Post by [deleted] » Sun, May 02, 2021, 1:25 AM UTC

josephg wrote: post #20

est31 wrote: post #6

App bundles allow smaller apk sizes [0]: > Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads. But as all this logic s…

Piling on here, thats super weird . The reason for digital signatures is that they make a claim. "As a representative of organisation A, the binary with shasum XXXX is our work. We stand behind it." Why would I generate a private key, then share my private key with google ? If google wants to claim that a binary they're shipping to users is same the one they received, they don't need my private key to do that. They c…

[deleted]

Re: Google I/O 2021 and Uncomfortable Questions

#27

Post by kjeetgill » Sun, May 02, 2021, 1:25 AM UTC

JollyMerchant wrote: post #7

Apple and Google, the Rockefeller and Standard Oil of our era.

In response to a now deleted comment about if they constitute monopolies:

Hm, I'm sympathetic to where people are coming from. Treating Apple Apps as a distinct market from Android Apps doesn't feel technically true, but I think it's more then true enough.

More generally I think people have a sense of what fair play is and how large companies shouldn't be as free to throw their weight around, laws be dammed. And that whole feeling gets lumped under monopoly.

Re: Google I/O 2021 and Uncomfortable Questions

#28

Post by saurik » Sun, May 02, 2021, 1:28 AM UTC

est31 wrote: post #6

App bundles allow smaller apk sizes [0]: > Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads. But as all this logic s…

It isn't just a "fear": Google has said that new apps submitted after August must use this feature.

Re: Google I/O 2021 and Uncomfortable Questions

#29

Post by colineartheta » Sun, May 02, 2021, 1:28 AM UTC

JollyMerchant wrote: post #7

Apple and Google, the Rockefeller and Standard Oil of our era.

Carnegie and Rockefeller might be more apt.

Re: Google I/O 2021 and Uncomfortable Questions

#30

Post by nodamage » Sun, May 02, 2021, 1:29 AM UTC

josephg wrote: post #20

est31 wrote: post #6

App bundles allow smaller apk sizes [0]: > Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads. But as all this logic s…

Piling on here, thats super weird . The reason for digital signatures is that they make a claim. "As a representative of organisation A, the binary with shasum XXXX is our work. We stand behind it." Why would I generate a private key, then share my private key with google ? If google wants to claim that a binary they're shipping to users is same the one they received, they don't need my private key to do that. They c…

> If google wants to claim that a binary they're shipping to users is same the one they received, they don't need my private key to do that. They can make their own signature, with their own key.

IIRC this is how it works by default for new apps. Uploading your existing signing key is only necessary for backwards compatibility to allow you to update existing apps that have already been published using that key.