Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google I/O 2021 and Uncomfortable Questions

commonsware.com

Post reply on HN
Print view View original

111–120 of 152 posts

Re: Google I/O 2021 and Uncomfortable Questions

#111

Post by UncleMeat »

_hyn3 wrote: post #3

tldr: Google's new app bundle signing might be a precursor (well, almost certainly is) to Google's being able to replace parts of and modify your app on the fly when installed by certain targeted users or within certain targeted countries at Google's whim, with users being none the wiser. Google might do this for a lot of reasons, and none of them seem to be good. FWIW, Google promises not to change the functionality…

It isn't really new. The feature has been an option for like three years. Google is just now making it so all apps are distributed in this manner.

Re: Google I/O 2021 and Uncomfortable Questions

#112

Post by bellyfullofbac »

prepend wrote: post #47
nodamage wrote: post #35

Earlier quoted context omitted.

> Which would give them ability to alter basically any app on the play store as they deem fit. Google already controls the operating system, the Play Store, and the SDKs you used to develop your app in the first place. If they wanted to alter your app there is already ample opportunity to do so, what additional trust do you gain by managing your own signing key here?

Isn’t it simply that any changes by Google would clearly not match the developer’s signature so are evident when they are different?

I don't want to defend Google here, but in theory, since Google controls the OS, it can also make it lie to you.

So you tell the OS to "show me this app's signature", and the OS can just lie and show you the expected signature. You want to copy the app to an SD card so you can check it on your Linux PC? The OS can copy the "legal" app.

Also yeah, it seems code signing won't affect anything if the OS wants to be malicious. "Super Secret Messaging App" asks the OS to load encrypt.so, its custom encryption library, and the OS can deliver a no-op library and say "Here it is!". The app wants to check the file's hash, the OS can intercept the hash method's return value and change it to the expected one...

Re: Google I/O 2021 and Uncomfortable Questions

#113

Post by lrem »

chedabob wrote: post #108
mcintyre1994 wrote: post #90

The article linked from this one is worth a read: https://commonsware.com/blog/2020/09/23/uncomfortable-questi... They claim that because Google strips the developer signature and signs it themselves, they can modify the app and re-sign it. They suggest that an authoritarian regime could coerce Google into serving modified versions of eg. E2E encrypted messaging apps to people of that regime’s choice as a condition o…

Apple issue the certificate but you never supply them with the private key. There's nothing stopping them from issuing a certificate with their own key though. It's not like Android where the signing key has to match otherwise apps can't be updated (amongst other things). They must be doing some re-signing on their side because the binary you upload is huge and it goes through optimisation on Apple's side so the user…

Do I understand correctly that Apple is already doing what Google wants to start doing here?

Re: Google I/O 2021 and Uncomfortable Questions

#114

Post by mcny »

izacus wrote: post #88
ce4 wrote: post #71

Earlier quoted context omitted.

The model also shields to a certain extent against conflict of interests (the product is the user, i.e. ads/tracking/hostile maintainership takeover)

> The model also shields to a certain extent against conflict of interests (the product is the user, i.e. ads/tracking/hostile maintainership takeover) Can you explain how? Since I've published things to F-Droid and since they also control signing and building (just like Apple and Google in this article), they can freely modify and change what's published on their store. Just like with Google and Apple, you need to i…

> Can you explain how? Since I've published things to F-Droid and since they also control signing and building (just like Apple and Google in this article), they can freely modify and change what's published on their store.

I think the perspective is that the distribution shields its users from possible upstream shenanigans (think stories that we used to hear about how popular free and open source Chrome extensions get bought and sold and ended up showing ads on Chrome opening page)

Re: Google I/O 2021 and Uncomfortable Questions

#115

Post by codeflo »

jayd16 wrote: post #60
remram wrote: post #24

Earlier quoted context omitted.

It's just a little bit weird that Google designed the Play Store and Android with key signing if they then have to ask for those keys. They control the OS and the store, couldn't they just make devices trust Google's app-repackaging-service's key? This would be easier for everyone, and more honest for the consumer user who gets packages signed by whoever actually built it.

This solution is backwards compatible. Changing the installation verification process is not.

So Google’s inability to update Android causes them to compromise on its security?

Re: Google I/O 2021 and Uncomfortable Questions

#116

Post by e3bc54b2 »

izacus wrote: post #88
ce4 wrote: post #71

Earlier quoted context omitted.

The model also shields to a certain extent against conflict of interests (the product is the user, i.e. ads/tracking/hostile maintainership takeover)

> The model also shields to a certain extent against conflict of interests (the product is the user, i.e. ads/tracking/hostile maintainership takeover) Can you explain how? Since I've published things to F-Droid and since they also control signing and building (just like Apple and Google in this article), they can freely modify and change what's published on their store. Just like with Google and Apple, you need to i…

The question is more of where the money is coming from. Google gets paid by advertisements so that's where their loyalties are.

F-droid is funded by contributions and donations, and they need both. They also have everything out in the open, which brings extra scrutiny.

And the last part is just culture. F-droid is a community project with clear set goals. Google also has clear set goals, they just don't happen to align with their users for the most part.

Re: Google I/O 2021 and Uncomfortable Questions

#117

Post by e3bc54b2 »

chickenbane wrote: post #82
_hyn3 wrote: post #3

tldr: Google's new app bundle signing might be a precursor (well, almost certainly is) to Google's being able to replace parts of and modify your app on the fly when installed by certain targeted users or within certain targeted countries at Google's whim, with users being none the wiser. Google might do this for a lot of reasons, and none of them seem to be good. FWIW, Google promises not to change the functionality…

> Google might do this for a lot of reasons, and none of them seem to be good. As a Play Store developer, I give Google the benefit of the doubt. By the way, before you assume a nefarious purpose, consider all Android phones connecting to the Play Store (by definition) have an auto-updating root process. Why does Google need to impersonate an application developer? This is fundamentally why Commonsware scare tactics…

> a lot of people lose their private signing key. And if that happens, no more updates to your app

That is a feature. If someone cannot do basic diligence of protecting the signing key, should I really trust them for executing code on my machine?

Re: Google I/O 2021 and Uncomfortable Questions

#118

Post by intricatedetail »

kibwen wrote: post #49
ashtonkem wrote: post #39

Earlier quoted context omitted.

Every content creator I follow seems pretty desperate to get away from YouTube. Creating a system where critical content creators are rewarded by an algorithm that requires burnout behavior continually does not seem like a long term stable business design.

> Creating a system where critical content creators are rewarded by an algorithm that requires burnout behavior continually does not seem like a long term stable business design. Sadly, history has shown that this is completely sustainable. Content creators that burn out will be replaced from among the legion of up-and-comers who are eager for their own shot at the spotlight, and are happy to sacrifice their well-bei…

It should be regulated. Creators for all intents and purposes are employees of YouTube and should at least be paid minimum wage, get holidays and sick pay. It's time YT gets Ubered.

Re: Google I/O 2021 and Uncomfortable Questions

#119

Post by thu2111 »

iudqnolq wrote: post #99
mcintyre1994 wrote: post #90

The article linked from this one is worth a read: https://commonsware.com/blog/2020/09/23/uncomfortable-questi... They claim that because Google strips the developer signature and signs it themselves, they can modify the app and re-sign it. They suggest that an authoritarian regime could coerce Google into serving modified versions of eg. E2E encrypted messaging apps to people of that regime’s choice as a condition o…

It's silly, because if you control the OS you control the app. They can push an OS or trusted app update that reads/writes the app's private data, or changes the shared libraries the app depends on, or with a little more work reads/writes the app's memory. Anyone claiming to provide protection from Google on a phone Google has remote root access to is selling a theatrical experience.

Google do not control the signing keys for Android for any phones other than their own Pixel line. So whilst true in theory, in practice the open source nature of Android with OEMs in the middle distributes the power around.
Post reply on HN