Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Open Letter to Google on Mandatory Developer Registration for App Distribution

keepandroidopen.org

Post reply on HN
Print view View original

281–290 of 392 posts

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#281

Post by iamnothere »

joshuamorton wrote: post #268
iamnothere wrote: post #263

Earlier quoted context omitted.

Amazon has a huge problem with packages being sent to fake people at different addresses. It’s part of review scams. This won’t be much different. Just send the verification to empty houses and apartments.

You now need to have a variety of fake addresses you can use, since scammed addresses will get banned. You also need fake IDs. So again, the bar has now been raised from "run a bot to make fake Facebook accounts" to "I have a large number of physical addresses and the ability to create arbitrary fake government IDs". > Amazon has a huge problem with packages being sent to fake people at different addresses. This usua…

I still think it’s doable. Fake IDs aren’t exactly hard to come by. You could also pay randos a $30 gift card to sign up for a developer account and share access. Enough people will do it. I guess this does raise the cost a little though.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#282

Post by simonask »

jrm4 wrote: post #205
crazygringo wrote: post #167

Earlier quoted context omitted.

> Life is not safe, nor can it be made safe without taking away freedom. So... no food and safety regulations, because life is not safe, and people should have the freedom to poison food with cheaper, lethal ingredients because their freedom matters more? You're right that things can't be made more safe without taking away the freedom to harm people. Which is why even the most freedom-loving countries on earth strike…

Your analogy is terrible because it doesn't do a proper accounting of "harm" and "risk." Food and seatbelts, that's literal health and life-and-death; very immediate and visible. "Cybersecurity" rarely is; and even when it is, the problem is that the centralized established authorities (like google) aren't at all provably good at this.

No, this is a terrible take. People’s entire financial future is at stake, including in the third world.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#283

Post by jhasse »

turblety wrote: post #13
drnick1 wrote: post #8

Isn't the obvious solution to use an AOSP fork that does not have to comply with the registration requirements? Distributions like Graphene and Lineage are completely unaffected.

Google are also destroying that path by delaying the releases more and more.

Even more reason to use these forks (and support them), right?

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#284

Post by TeMPOraL »

gretch wrote: post #94
bigstrat2003 wrote: post #67

Earlier quoted context omitted.

> I agree that mandatory developer registration feels too heavy handed, but I think the community needs a better response to this problem than "nuh uh, everything's fine as it is." Why would the community give a different response? Everything is fine as it is. Life is not safe, nor can it be made safe without taking away freedom. That is a fundamental truth of the world. At some point you need to treat people as adul…

> At some point you need to treat people as adults, which includes letting them make very bad decisions if they insist on doing so. That's right, it's your decision to use Android. If you choose to do so, that's on you.

It's not like there's much of an alternative, but that's irrelevant anyway. Android is becoming more like an iPhone, and as long as the OS is able and willing to reliably report to anyone asking just how tightly it is locked down, we have zero choice in the matter, because increasingly many important apps (like bank and government apps) plain refuse to work if device is locked down less than it could be.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#285

Post by jhasse »

shimman wrote: post #147
gleenn wrote: post #11

Earlier quoted context omitted.

It matters to me because I'm reading it now and feel more informed about this problem. Throwing the towel in and saying it's all pointless isn't helpful.

It's not throwing in the towel, it's about doing things that we the people can actually do. One thing, we the people can do, is pressure our politicians to break up Google along with the rest of big tech. There are many primary challengers this cycle that are running anti-monopoly platforms. Help their cause, signing pointless petitions is just West Wing style fantasy that is extremely childish.

We can also do both, right? :)

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#286

Post by jhasse »

jeroenhd wrote: post #56
dvh wrote: post #14

Wrong approach. Vote with your wallet instead. My next mobile phone will not have OS from Google (not from Apple).

What phone are you considering? Sailfish still doesn't seem very successful and mobile Linux barely boots on anything that performs better than a fifteen year old budget device. I'm kind of hoping Qualcomm's open sourcing work will also affect the ability to run mainline Linux on Android devices, but it's looking like a Linux OS that covers the bare basics seems to be a decade away.

Fairphone 6 with /e/OS for example.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#287

Post by Tharre »

tadfisher wrote: post #270
Tharre wrote: post #260

Earlier quoted context omitted.

> do not control the signing key which is ultimately used to associate app domain passkey, and they do not control the system credentials service which checks this association. You're assuming the attacker must go through the credential manager and the backing hardware, but that is only the case with attestation. Without it, the attacker can simply generate their own passkey in software, because the backend on the ba…

How did the service authenticate the user in order to create the new credential within the attacker-controlled app?

With banks, typically a combination of your account number, pin and some confirmation code sent via email or SMS. And of course unregistering your previous device. Not sure where you're going with this though?

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#288

Post by TeMPOraL »

mwwaters wrote: post #240
Hizonner wrote: post #121

Earlier quoted context omitted.

If the actual bank app does that, or is even easy to fool into doing that, then the bank should be responsible. That's the world "regular people" want and it's the world as it should be. If random malware the user chose to install does that, then that is not the bank's fault . The bank is no more involved than anybody else. And no, I don't think "regular people" want to make that the bank's fault.

The legal infrastructure for banking and securities ownership has long had defaults for liability assignment. For securities, if I own stock outright, the company has to indemnify if they do a transfer for somebody else or if I lack legal capacity. So transfer agents require Medallion Signature Guarantees from a bank or broker. MSGs thereby require a lengthy banking relationship and probably showing up in person. For…

> Basically for the sizable transfers, there is relatively little faith in the user’s computers (including phones). To the extent there is faith, it has total liability on some capitalized party for fraud.

But that is expensive, so my impression is that for non-sizeable transfers, and beyond banking, for basically anything dealing with lots of regular people doing regular-people-sized operations, the default in the industry is to try and outsource as much liability onto end-users. So instead of treating user's computers as untrusted and make system secure on the back end, the trend is to treat them as trusted, and then deal with increased risk by a) legal means that make end-users liable in practice (keeping users uninformed about their rights helps), and b) technical means that make end-user devices less untrusted.

b) is how we end up with developer registries and remote attestation. And the sad thing is, it scales well - if device and OS vendors cooperate (like they do today), they can enable "endpoint security" for everyone who seeks to externalize liability.

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#289

Post by jhasse »

jonathanstrange wrote: post #5

For me this change is a problem not just because of the ID upload to Google but mainly because it's another nail in the coffin of native software solutions. It increases friction and anything that increases friction is bad. Concretely, my original plan was to provide an .apk for manual installation first and tackle all this app store madness later. I already have enough on my plate dealing with macOS, Windows, and Li…

Did your users really consider your app if it wasn't in the Play Store?

Re: Open Letter to Google on Mandatory Developer Registration for App Distribution

#290

Post by TeMPOraL »

tzs wrote: post #164
Cyph0n wrote: post #107

Earlier quoted context omitted.

Right, but this same problem (scamming) exists on PCs. Would it make sense to then argue that enforcing TPM-backed measured boot and binary signature verification is a legitimate way to address the problem?

Their point, applied to that situation, would be that if someone does argue for enforcing TPM-backed measured boot yadda yadda to address scamming, trying to counter it by dismissing scamming as not a real problem is useless.

Scamming is a real problem, but that does not imply this solution is the right way to go about it. There are other means to address this problem; they may not scale as well, but they also don't sacrifice computing freedoms.
Post reply on HN