Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

Post reply on HN
Print view View original

241–250 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#241

Post by Barrin92 »

krageon wrote: post #193
Barrin92 wrote: post #111

Earlier quoted context omitted.

>yeah this is one reason why I can't take mobile app end to end encryption, or client side only, claims seriously. If it's a large company like Facebook that values these products like Whatsapp at billions I trust them at least on this issue. I'm pretty sure they're not going to put junk third party malware for 50k into the Whatsapp client. This is mostly an issue for apps done by individual developers who have huge…

> I trust them You literally mentioned a company that betrayed trust so bad a government tried to call them to account.

Are people capable of enough nuance to distinguish between issues that large tech firms are likely trustworthy on and issues that they aren't?

When they stand to make billions from breaking my trust I'm sceptical. When they stand to make a penny and ruin their entire product, then no I' not.

The problem in question here, that rogue developers sell out their product to third parties, is not an issue that Facebook, Google etc have. They have every incentive to keep their software secure.

Re: Barcode scanner app on Google Play infects 10M users with one update

#242

Post by logicchains »

Ensorceled wrote: post #240
bbarn wrote: post #230

Earlier quoted context omitted.

"Better" is certainly a point of view here. Having to tell the government all of your whereabouts when you already live on an Island with no spreading is an overreach, IMO.

The 21,000 dead here in Canada would like to argue that it is much, much better but, well, they can't. I literally can not believe you are arguing it's not better.

Believe it or not but not everybody believes that human rights like privacy are always optional when lives are at stake. Ever heard of the phrase "the end doesn't justify the means"?

Re: Barcode scanner app on Google Play infects 10M users with one update

#243

Post by Ensorceled »

bbarn wrote: post #231
protoman3000 wrote: post #216

Earlier quoted context omitted.

You’re right. How dare Microsoft abuses their monopoly and ships Windows with a clock in the taskbar! And why stop here? We should open the market for TCP implementations. The status quo is anti-competitive and stifles innovation!

Funny how Microsoft's including a useful tool for you know, getting on the internet, with their OS was the subject of an anti-trust suit just a few decades ago and now it's ok to force users to purchase all apps from the apple store, which takes 30% from every company wanting to sell an app on iOS.

Anti-trust has many fewer teeth that it used to.

Re: Barcode scanner app on Google Play infects 10M users with one update

#245

Post by II2II »

protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

> Apps that offer what should have been offered by the OS vendor in the first place.

The questions are: how do you decide is necessary and how do you present it to the user? Different people have different needs and making every should have been feature visible ends up making every other feature less visible. That may be fine if you're developing software for a specialist who will take the time to learn a particular application which is relevant to them, but it's a drawback when you're creating software for a general audience since only a handful of enthusiasts will take the time to learn the software.

Re: Barcode scanner app on Google Play infects 10M users with one update

#246

Post by krageon »

Barrin92 wrote: post #241
krageon wrote: post #193

Earlier quoted context omitted.

> I trust them You literally mentioned a company that betrayed trust so bad a government tried to call them to account.

Are people capable of enough nuance to distinguish between issues that large tech firms are likely trustworthy on and issues that they aren't? When they stand to make billions from breaking my trust I'm sceptical. When they stand to make a penny and ruin their entire product, then no I' not. The problem in question here, that rogue developers sell out their product to third parties, is not an issue that Facebook, Goo…

A betrayal of trust will not "ruin their entire product", we've already seen that it won't (no matter the scale). Believing a small betrayal to be worse than a big one is your right, but that doesn't mean it isn't naive.

Re: Barcode scanner app on Google Play infects 10M users with one update

#247

Post by tonyedgecombe »

pcthrowaway wrote: post #172
protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

I'm terrified of browser extensions for this very same reason (and yes, I still use them). I wish the browser vendors supported some kind of pinning to source code for open source extensions. Right now I have at least 2 extensions running that I know could access my passwords on any website as I enter them. One of those is Lastpass, which I use for storing/generating those passwords anyway, and the other is AdBlock P…

At least with LastPass you know they have a commercial model and reputation to incentivise better behaviour. If you download something that is free then that pressure doesn't exist.

Re: Barcode scanner app on Google Play infects 10M users with one update

#248

Post by marcodiego »

ignoramous wrote: post #187
aq3cn wrote: post #131

I stick to F-droid android app store. it asks developer to submit their code which gets compiled by the F-Droid team. apps with proprietary codes are flagged. few QR code apps from F-Droid. https://f-droid.org/en/packages/com.example.barcodescanner/ https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...

Open source apps can absolutely have trackers in them. F-Droid isn't a security solution by any measure. I have inspected code of at least one popular "privacy" app that absolutely tracks its users out in the open (I mean, the code is right there on GitHub), yet I see repeatedly that app (and F-Droid) being touted as some elixir that fixes security and privacy for one and all. It doesn't. Don't place your trust on F-…

F-droid flags apps that have known anti-features. Using Open source software is a very significant security solution.

Re: Barcode scanner app on Google Play infects 10M users with one update

#249

Post by 2muchcoffeeman »

bjarneh wrote: post #227
mschuster91 wrote: post #226

Earlier quoted context omitted.

> Why are Google afraid to release a free non-harmful version of those popular apps. Fear of anti-competition lawsuits and complaints. They're seeing what happens when Apple integrates stuff into iOS / OS X core that previously were third party provided, or the flak that Amazon gets for pushing AmazonBasics products.

> Fear of anti-competition lawsuits and complaints. They could just create an open source variant that suddenly shows up top when people search for QR or barcode scanner. It would be in their best interest, and it would not violate any anti-competition laws, nobody can demand to see how these apps are ranked I guess?

Manipulating the search results so blatantly? How are they going to do this without generating more criticism?

It’s better to bake it into the OS and push an update. But then you’d have to get an OS update to heaps of phones.

Re: Barcode scanner app on Google Play infects 10M users with one update

#250

Post by sdefresne »

captn3m0 wrote: post #150
bjarneh wrote: post #143

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

It is 2021 and Android still doesn't have a QR code scanner by default.

The stock Camera app on my Android phone recognises QR codes. This is on Android 11 on a Pixel 3. I think this has been the case for a few versions of the OS (but don't have access to old versions to check).
Post reply on HN