Why do I care? Google can already modify the behavior of an app without the developer's permission; they can just push an update to Android that changes the behavior of that app. It's "reflections on trusting trust" all over again.
Google I/O 2021 and Uncomfortable Questions
61–70 of 152 posts
Re: Google I/O 2021 and Uncomfortable Questions
#62App bundles allow smaller apk sizes [0]: > Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads. But as all this logic s…
I seriously doubt 99% of Google Play developers worry enough that they would take the time and money to run a signing server, and that would introduce a lot of complexity for Google.
How is an automated signing server better security anyway? Google can still sign what they want but now every dev has a missive security hole in the form a server that can sign code reachable from the open web?
Re: Google I/O 2021 and Uncomfortable Questions
#63Earlier quoted context omitted.
"The whole point of this feature is to allow Google to modify the APK by stripping out unneeded resources to reduce file size." Why couldn't Google just ask the developer to sign the modified app after Google makes its changes (which the developer should only do if they approve the changes)?
PITA, most likely. More round trips. More complexity. More work for the user. It also means that the bundling process cannot be improved and you can't extend it to support new configurations without the involvement of the user. There are a bazillion locales and device configurations out there, with more created every day.
Why not let the developer generate the tailored binaries in the first place?
Re: Google I/O 2021 and Uncomfortable Questions
#64Earlier quoted context omitted.
> Which would give them ability to alter basically any app on the play store as they deem fit. Google already controls the operating system, the Play Store, and the SDKs you used to develop your app in the first place. If they wanted to alter your app there is already ample opportunity to do so, what additional trust do you gain by managing your own signing key here?
Isn’t it simply that any changes by Google would clearly not match the developer’s signature so are evident when they are different?
If the signature does not match that tells you the app was tampered with, but the inverse is not true when your "adversary" controls the compiler, installer, and the operating system itself. Reflections on Trusting Trust (https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...) provides a good explanation as to why.
Re: Google I/O 2021 and Uncomfortable Questions
#65App bundles allow smaller apk sizes [0]: > Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads. But as all this logic s…
A good workaround could be that you sign a manifest containing all the files and a version number, and Google signs the APK.
(The version number prevents mix-and-match attacks where e.g. an old vulnerable file is reused in a new APK.)
Re: Google I/O 2021 and Uncomfortable Questions
#66Earlier quoted context omitted.
it doesn't matter, they could just push an android update that bypasses your signature if they really wanted to. granted that's a bigger deal, but they control the ecosystem in google play and hold the signing keys for android and google play itself, you already trust them.
If the only person with the signing key is the author, then any user could verify the signature outside of Android, could they not? Instead, even outside of Android, we simply cannot know.
Except verifying outside of Android tells you nothing about whether the application as installed on an actual device has been tampered with, so you don't really gain any security from this.
Re: Google I/O 2021 and Uncomfortable Questions
#67App bundles allow smaller apk sizes [0]: > Google Play uses your app bundle to generate and serve optimized APKs for each device configuration, so only the code and resources that are needed for a specific device are downloaded to run your app. You no longer have to build, sign, and manage multiple APKs to optimize support for different devices, and users get smaller, more-optimized downloads. But as all this logic s…
It isn't just a "fear": Google has said that new apps submitted after August must use this feature.
[citation needed]
Re: Google I/O 2021 and Uncomfortable Questions
#68tldr: Google's new app bundle signing might be a precursor (well, almost certainly is) to Google's being able to replace parts of and modify your app on the fly when installed by certain targeted users or within certain targeted countries at Google's whim, with users being none the wiser. Google might do this for a lot of reasons, and none of them seem to be good. FWIW, Google promises not to change the functionality…
Wouldn't a simple solution to this be a double signing of one and the same app by both Google and the app's author? That way, if Google changes the app and signs it, while the author only signed the unchanged app, then the author's signature would no longer validate on the new, changed app. Or am I missing something?
I suspect this is more about Google asserting greater long-term control over apps in the store than anything else. If Google holds the keys it makes it harder, if not impossible, for an author to say 'no' to some unspecified future change(s). As an app developer having watched Google play this game over the last decade, I'd bet money on it.
Re: Google I/O 2021 and Uncomfortable Questions
#69Given that Google has a history of accidentally breaking things in YouTube that only impacts Firefox, I'm 100% certain they can be trusted to muck around in apps written by others. Think of the opportunities. Next time Google releases a new social media system they can automatically add it into every existing Android app as a login option! Google dropping their payment system again? Not a problem, they can just chang…
> Given that Google has a history of accidentally breaking things in YouTube that only impacts Firefox
For those not in the loop about this: https://archive.is/ODWrQ
Re: Google I/O 2021 and Uncomfortable Questions
#70I recently finished the book "The Age of Surveillance Capitalism." If you *really* want to understand Google - the real Google, not the PR spun version - then this book is a must read.
https://www.wnycstudios.org/podcasts/otm/segments/living-und...