Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Google on Mandatory Developer Registration for App Distribution

keepandroidopen.org

Post reply on HN
Print view View original

181–190 of 392 posts

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#181

Post by philistine »

bigstrat2003 wrote: post #124
gmueckl wrote: post #109

Earlier quoted context omitted.

The reality in South East Asia doesn't support that. You're assuming that the potential victims are able to either use Android alternative or that they are willing and able to educate themselves about scams. The reality in these countries is that neither is the case in practice. Daily lives depend a lot on smartphones and they play a big role in cashless financial transactions. Networking effects play a big role here…

The status quo may not be perfect but it is the best we can do. We try to educate people about scams. We give them warnings that what they are doing can be dangerous if misused. If they choose to ignore those things and proceed anyway, the only further step society could take is to take away the person's freedom to choose. And that is an unacceptable solution.

> The status quo may not be perfect but it is the best we can do.

Nope. We could, for example, ask developers to register with their legal identity to release apps.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#182

Post by sheiyei »

bigstrat2003 wrote: post #123
zeroxfe wrote: post #97

Earlier quoted context omitted.

> At some point you need to treat people as adults, which includes letting them make very bad decisions if they insist on doing so. The world does not consist of all rational actors, and this opens the door to all kinds of exploitation. The attacks today are very sophisticated, and I don't trust my 80-yr old dad to be able to detect them, nor many of my non-tech-savvy friends. > any more than it would be acceptable f…

It's not a false equivalence at all. Both situations are taking away someone's control of something that they own, borne from a paternalistic desire to protect that person from themselves. If one is acceptable, the other should be. Conversely if one is unacceptable, the other should be unacceptable as well. Either paternalistic refusal to let people do as they wish is ok, or it isn't.

Protecting from scams isn't protection from the victim themselves. That should be obvious from the fact that very intelligent and technologically literate people too can fall for phishing attacks. Tell me for example, how many people in your life know how a bank would ACTUALLY contact you about a suspected hijacking and what the process should look like? And how about any of the dozens of other cover stories used? Not to mention the situations where the scammers can use literally the same method of first contact as the real thing (eg. spoofed). ...And the fact that for example email clients do their best to help them by obscuring the email address and only showing the display name, because that's obviously a good idea.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#183

Post by iamnothere »

crazygringo wrote: post #167
bigstrat2003 wrote: post #67

Earlier quoted context omitted.

> I agree that mandatory developer registration feels too heavy handed, but I think the community needs a better response to this problem than "nuh uh, everything's fine as it is." Why would the community give a different response? Everything is fine as it is. Life is not safe, nor can it be made safe without taking away freedom. That is a fundamental truth of the world. At some point you need to treat people as adul…

> Life is not safe, nor can it be made safe without taking away freedom. So... no food and safety regulations, because life is not safe, and people should have the freedom to poison food with cheaper, lethal ingredients because their freedom matters more? You're right that things can't be made more safe without taking away the freedom to harm people. Which is why even the most freedom-loving countries on earth strike…

Thank goodness there are FOSS options, even for mobile phones, and none of us are required to accept proprietary junk.

If they make FOSS illegal, guess I’ll be a criminal. Come and take it.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#184

Post by Retr0id »

UncleMeat wrote: post #149
Retr0id wrote: post #78

Earlier quoted context omitted.

> the malware captures their two-factor authentication codes Aren't we supposed to have sandboxing to prevent this kind of thing? If the malware relies on exploiting n-days on unpatched OSes, they could bypass the sideloading restrictions too.

Codes arrive via SMS, which is available to all apps with the READ_SMS permission. This isn't an OS vuln. It is a property of the fact that SMS messages are delivered to a phone number and not an app. On the Play store there is a bunch of annoying checking for apps that request READ_SMS to prevent this very thing. Off Play such defense is impossible.

If they restricted sideloaded apps from sniffing SMS then I wouldn't mind all that much.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#185

Post by andyferris »

pas wrote: post #165
WarmWash wrote: post #158

The judge told Google that Apple is not anti-competitive because Apple has no competitors on it's platform (this all stemming from the Epic lawsuits). Google listened. Blame the judge for one of the worst legal calls in recent history. Google is a monopoly and Apple is not. Simple fix for Google... Same comment I made a few days ago, I feel it bears repeating as much as possible until it's really driven home how detr…

Sorry, which exact ruling are you referring to? How did the court arrived at this finding (that seems irrelevant, false)?

There were parallel anti-competitive behavior cases brought against Apple and Google.

Apple was deemed not to be anticompetitive in app stores because there was no existing market of app stores on iOS. Google was more open in allowing other app stores, but deemed anticompetitive by discouraging their use relative to the Play store.

The irony is the more open player was deemed more anticompetitive. OP is saying Google is “fixing” their anticompetitive behavior by eliminating alternative app stores entirely.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#186

Post by nmeagent »

bitwize wrote: post #84
Cyph0n wrote: post #46

Earlier quoted context omitted.

Does your logic extend to PCs? If not, why? Because I hope you realize that clamping down on “sideloading” (read: installing unsigned software) on PCs is the next logical step. TPMs are already present on a large chunk of consumer PCs - they just need to be used.

Of course it extends to PCs. It'd suck for us, but end users, software vendors, content providers, and service providers all benefit from a more restricted platform that can provide certain guarantees against malware, fraud, piracy, and so forth. It's pathologically programmer-brained to assume that the good old days of being able to run arbitrary code on a networked computing device would last forever. That freedom…

> That freedom must be balanced against the interests of the rest of society to avoid risk from certain kinds of harm which can easily proliferate in an environment where any program can run with the full authority of the owner and malware spreads willy-nilly.

No, no, a thousand times no. This is an argument for authoritarian clampdown on general computing and must be opposed by all means necessary. I have the right to run whatever code I wish on my own damn property without the permission of arbitrary authorities or whatever subset of society you favor, and if you or they have a problem with this, you or they can proceed to pound sand.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#187

Post by Tharre »

Retr0id wrote: post #122
Tharre wrote: post #117

Earlier quoted context omitted.

Read my previous comment again. Passkeys are nice, but they don't solve the problem that's being discussed here.

I'm not sure if you understand what makes passkeys phishing-resistant? The backdoored version of the app would need to have a different app ID, since the attacker does not have the legitimate publisher's signing keys. So the OS shouldn't let it access the legitimate app's credentials.

I understand how passkeys work. You don't need the legitimate app's credentials, we're talking about phishing attacks, you're trying to bring the victim to giving you access/control to their account without them realizing that that's what is happening.

A simple scenario adapted from the one given in the android blog post: the attacker calls the victim and convinces them that their banking account is compromised, and they need to act now to secure it. The scammer tells the victim, that their account got compromised because they're using and outdated version of the banking app that's no longer suppported. He then walks them through "updating" their app, effectively going through the "new device" workflow - except the new device is the same as the old one, just with the backdoored app.

You can prevent this with attestation of course, essentially giving the bank's backend the ability to verify that the credentials are actually tied to their app, and not some backdoored version. But now you have a "blessed" key that's in the hands of Google or Apple or whomever, and everyone who wants to run other operating systems or even just patched versions of official apps is out of luck.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#188

Post by bigstrat2003 »

philistine wrote: post #181
bigstrat2003 wrote: post #124

Earlier quoted context omitted.

The status quo may not be perfect but it is the best we can do. We try to educate people about scams. We give them warnings that what they are doing can be dangerous if misused. If they choose to ignore those things and proceed anyway, the only further step society could take is to take away the person's freedom to choose. And that is an unacceptable solution.

> The status quo may not be perfect but it is the best we can do. Nope. We could, for example, ask developers to register with their legal identity to release apps.

That would be worse than the status quo.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#189

Post by iamnothere »

eikenberry wrote: post #129
bitwize wrote: post #84

Earlier quoted context omitted.

Of course it extends to PCs. It'd suck for us, but end users, software vendors, content providers, and service providers all benefit from a more restricted platform that can provide certain guarantees against malware, fraud, piracy, and so forth. It's pathologically programmer-brained to assume that the good old days of being able to run arbitrary code on a networked computing device would last forever. That freedom…

The "programmer-brained" assumption is that I will be able to write any program and run it on my machine and that this ability isn't reserved for only me or some limited class of people and that I can share what I write with others. One big plus of the current stye of AI will be that "end users" will be able to write simple programs and will value this ability. Thus helping protect general purpose computing from this…

Exactly. I own a few dozen computers, if you count some low powered SBCs. But even those can run lightweight Linux.

That’s enough for me to distribute a few freedom devices to friends and neighbors, and still have extras to account for normal failures.

I also hoard source code, and will happily distribute that with the computers! Maybe that’s “programmer brained,” if so then fine by me!

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#190

Post by singpolyma3 »

jdlyga wrote: post #168

To be honest, if both Android and iOS were walled gardens, I'd choose iOS every time. I choose Android specifically because of its openness. But if that weren't the case, I'd prefer the smoother UX and stronger Apple ecosystem.

You're welcome to it I suppose. As someone forced to use iOS for the past year I'm still waiting to find any smooth UX or strong ecosystem...
Post reply on HN