After the news cycle recently exploded with the announcement that Google would require every single Android app to be from a registered and verified developer, while killing third-party app stores …
The vast majority of malware isn’t delivered via play store because of the existing measures and protections they have. Same reason you see very little app-store-based malware on iOS. DISCLAIMER: YES MALWARE EXISTS ON APPLE HARDWARE PLEASE DON’T SHOUT AT ME. Talking specifically about anything installed via first party stores on both platforms.
Their main issue is this: dumb people install apks from spurious website and infect their phones. The least controllable and most pervasive factor here is the intelligence and knowledge of the user which cannot be controlled for by Google. So by eliminating the ability to exploit this entirely, it will eliminate that specific vector.
It’s a sledgehammer solution that naturally comes with many downsides like disrupting intelligent and knowledgeable users that just want to hack around with FOSS and such.
Google is relying on It being too expensive for malware creators to have to guide each individual user through adb installation and usage process just to get access to their phone. Most scammers only do that level of interaction to extract actual cash/gift cards from the target.
I am personally and directly affected by their decision in many negative ways, but I’m not so dense as to not understand why they’re doing it.
/corpodronespeak
EDIT: bots help Xitter maintain inflated usage figures which justify people’s jobs, share prices, etc. Bots are a feature, not a bug.
Because it can be invalidated. That’s the difference.
It’s absolutely not foolproof, but nothing is. Most actions corps take for this stuff only slows down the spread. Hackers and bad actors innovate way faster than companies can keep up with. So companies cast a wide net with their solutions. And the cycle continues.
with the new system, you must go online to check if the license for that app is still valid or revoked. But the current system works almost the same: if there’s an internet connection play protect checks the signature against an online malware db and prevents installation.
From a couple years ago, google has the power to remotely install/uninstall any apk on your phone without your consent
The vast majority of malware isn’t delivered via play store because of the existing measures and protections they have. Same reason you see very little app-store-based malware on iOS. DISCLAIMER: YES MALWARE EXISTS ON APPLE HARDWARE PLEASE DON’T SHOUT AT ME. Talking specifically about anything installed via first party stores on both platforms.
Their main issue is this: dumb people install apks from spurious website and infect their phones. The least controllable and most pervasive factor here is the intelligence and knowledge of the user which cannot be controlled for by Google. So by eliminating the ability to exploit this entirely, it will eliminate that specific vector.
It’s a sledgehammer solution that naturally comes with many downsides like disrupting intelligent and knowledgeable users that just want to hack around with FOSS and such.
Google is relying on It being too expensive for malware creators to have to guide each individual user through adb installation and usage process just to get access to their phone. Most scammers only do that level of interaction to extract actual cash/gift cards from the target.
I am personally and directly affected by their decision in many negative ways, but I’m not so dense as to not understand why they’re doing it.
/corpodronespeak
EDIT: bots help Xitter maintain inflated usage figures which justify people’s jobs, share prices, etc. Bots are a feature, not a bug.
yes, of course malware is distributed via apk.
But what’s the difference between:
?
Isn’t exactly the same stuff? Or there’s someone that is actually thinking that criminals will use their real ID card for the verification?
Does not change anything for malware distribution, except bother them for a dozen minutes meanwhile they “verify” their stolen ID
Because it can be invalidated. That’s the difference.
It’s absolutely not foolproof, but nothing is. Most actions corps take for this stuff only slows down the spread. Hackers and bad actors innovate way faster than companies can keep up with. So companies cast a wide net with their solutions. And the cycle continues.
Apks can be invalidated after installation?
with the new system, you must go online to check if the license for that app is still valid or revoked. But the current system works almost the same: if there’s an internet connection play protect checks the signature against an online malware db and prevents installation.
From a couple years ago, google has the power to remotely install/uninstall any apk on your phone without your consent
No, the certificate can be invalidated preventing future installations for other users. If you already have it you’re SOOL