Slashdot Mirror
Google is Adding Anti-Tampering DRM To Android Apps in the Play Store (androidcentral.com)
Google has introduced a small change to Play Store apps that could significantly protect several Android users. From a report: Earlier this week, Google quietly rolled out a feature that adds a string of metadata to all APK files (that's the file type for Android apps) when they are signed by the developer. You can't install an application that hasn't been signed during its final build, so that means that all apps built using the latest APK Signature Scheme will have a nice little chunk of DRM built into them. And eventually, your phone will run a version of Android that won't be able to install apps without it.
The article is dismissive of the direction this is heading, but in a world where 99% of the people using a mobile device simply have no ability to manage digital security, you just can't continue to allow people to install something from anywhere.
As a technical user I absolutely want there to be way more open options where people with technical ability have a lot of freedom as to what they can do, and I'm sure some Android devices will continue to provide that. But the world also absolutely needs Apple-level closed off system like the App Store that protects people who cannot protect themselves from remote exploitation and harm.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Right now, you can sideload by clicking through a disclaimer. Will you still be allowed to sideload unsigned apps (say, for your own testing)?
What about installing an older version of an app if your version of Android doesn't support the new one? Will this be used to enforce regional restrictions (i.e. Facebook Messenger Lite is much less intrusive than the full Messenger, but isn't available in the US Play Store)?
And the rest of us must suffer the mighty fist of dictatorial oppression?
APK Signature Scheme = A.S.S. Not the best choice of acronym.
I don't buy Apps from Google Play, I buy them from Amazon.
I seem to remember that developers need to sign their apps already (and have for many years). What am I missing?
If you have to explain your *hilarious* wordplay it's already failed.
It's not meant to be hilarious -- it's meant to be an expression of utter contempt towards the "Cloud" and the corporate scum who are attempting to nudge users to give them their personal data.
Adding an origin signature simply helps prevent the spread of malware as a device can verify that it is a legitimate package instead of some compromised apk. This has been an issue for a long time even in the west where users have internet access (fortnite apk!1!) and has been much more problematic where people have limited and expensive internet.
This does nothing to solve the malware problem on Android, because the malware is being distributed by "legitimate" vendors directly on the Play Store.
I get complaints of full-screen video ads in my ad-free apps from users who have never side-loaded anything. Malicious apps are launching them from the background, which is against the TOS, but technically trivial to do. If they get caught, they either call it a bug or start another company/product-line.
As far I can tell, Google promotes the highest revenue generating apps...so the dirtier the tactics you use, the more you succeed.
The bad apps do take a beating on reviews from legitimate users, but this is worked around by the developers posting massive quantities of fake reviews. It's presently somewhat easy to spot, legit apps will have reviews that are generally 1-3 sentences long, while fraudulent ones will have pages of 1-3 word reviews (often clustered together). Google doesn't seem to care though, as even some of the most popular apps are doing this to counter backlash from ever more ridiculously aggressive in-app advertising.
And then of course there's the problem that the average app today is so invasive of privacy that it would have been deemed outright malware ten years ago.
The only reason people behave so damn retarded with regard to computers ... and I mean on a level that qualifies as literally mentally disabled ... is because tech firms have treated people like non-independent retards until they were.
No, its because there are millions of people using computers today who just 25 years ago wouldn't have the basic knowledge to even work out how to put the system they'd bought together, let alone how to get online. Once upon a time using a computer required a reasonable amount of technical knowledge or at least an IQ sufficient enough to learn.
I only please one person per day. Today is not your day. Tomorrow isn't looking good either. - Scott Adams
All you computer geeks who really know your computers, but can't change a tire or design an airplane, please desist from using any mechanical devices. We can't have non-independent retards like you taking advantage of other people's specializations.
that's why Mozilla started signing apps. It gives them a kill switch in case a plugin author sells their plugin to someone dishonest. There's been a few moderate profile cases of it happening (nothing more than a few hundred thousand users, which sounds like a lot until you realize how many FF users there are).
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
We - the engineers who wrote the software your company uses to generate profit - are watching. Screw us out of our own systems, and we will replace you, as we did those before you.
A government is a body of people notably ungoverned - AC
Coincidentally google just released a "special internal test build" track in the Google Play store that doesn't go through malware scanning and "is only for use within your organization", but has a much faster go-live time.
Your ad here. Ask me how!
Since it really does very little (if anything) for security anyhow.
Uh... that wasn't me, dipshit.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
when I posted it before here [link to the post you're replying to for the second time]
Uh...
LAME & WEAK - another method from me
Indeed, another lame and weak method from you...
also a PROTECTIVE TECHNIQUE I use in my hosts file engine
So you invented the digital signature? Or is it someone else's invention and work that you're using, much like the hosts file and the host lists you concatenate, while bitching about people using your initials as though you're the only APK in the world? Here's a hint: you're not, and many of them are far more notable and recognizable than you.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Big Brother Google is too big, too invasive, too untrustworthy. It's time for Uncle Sam to get out his trust-busting stick and break up Google/Alphabet.
Maps - separate company
Search - separate company
Surveillance / "advertising" - separate company
Android - separate company
Chrome - separate company
You're talking about the nation which brought us Hillary and Donald. Why would you expect them to have any sense when it comes to computing?
THANKS FOR THAT MUCH & since you like the Windows model (perfectly accurate)?
I never said I liked it, I said the work was good. If I liked it, I would use it, and I don't (and if I did, I would admit as much; I'm not one to bit off my nose to spite my face). You should know from the rest of that conversation that I would never use software written by someone as toxic and vile as you. It may be clean and safe today, but there's no reason to believe it will remain that way, particularly when you seem to have personal vendettas against so many people, myself included, and it would be trivial to throw some nastiness in that only triggers when the software detects that it is running on a system used by one of those people (for example, by looking for browser cookies of Slashdot logins for your targeted individuals).
You see, we're not all as stupid as you think us. If we were, we'd make easy targets for exploit by your wares.
Continued in reply to your 2nd reply...
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Congratulation, you're the typical kind of people who hang on /. (ultra curious geeks, etc.)
The thing is that, there's the rest of the world, we're a bit north of 7 billion of humans on this planet.
Out of them not every one last of them thinks the same way as us.
Some just want an appliance, a thing that just works when they push a button.
There are people who can rebuild the old faulty electrical wiring of a dilapidated house.
and there are the people who just want the light to turn on when they push a button and are happy to give money to someone else to make it happen and don't *want* to give a damn about what's going on under the hood.
Apple, and the "walled garden" type of application platforms try to solve this regarding phone.
There are people who (for a good reason) release that they have a full blown personal computer in their pocket.
And there are people who just want to talk to their friends and send funny pictures of cat, and don't want to give a flying fuck about what an "operating system" is.
The only thing which I'm not happy with and which several people have talked in this thread, is that some like Apple and lots of Android manufacturer want to give you NO ALTERNATIVE to the walled garten, they do not give you the key to the main gate of the metaphorical garden's wall.
I would prefer phone that are locked-down BUT can be unlocked and put into developer mode if desired by the owner ( <- dear phone companies, please note the word and stop considering us as rental. We paid it, we own it, thanks).
---
Also a thing to think about is that some point in the future, the big fat warning upon activating the dev mode won't be enough.
- People get desensitized by clicking "Okay" on any pop-up warning. (Same problem that windows have since they introduced UAC due to problematic software that can't run on anything but admin mode).
- The "dancing pigs" problem : people are ready to follow any weird complex instructions from shady corners of the web just to get access to the funny video of dancing pigs (like installing some horrible spyware/botnet node that pretends to be a video player and codecs for the video). You can predict that if one day when the walled garden gets a little too efficient at rejecting malware to the taste of attacker, youtube bot-channels are going to pop up with "howtos" tutorials explaining how to put the smartphone in dev mode to side load "the best app to send video of kittens around" prompting even grandma to shoot themselves in the foot security-wise.
We'll have to think and prepare how to deal with this in the future (if we don't the manufacturing companies will choose the "more DRM" solution instead for us).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
(cont.) Also, it seems that much has changed in the quality of your software in the past two years and several months. You see, there appears to be a glaring bug in your Slashdot spamming script that is causing it to double-post, though the grammar modification algorithm appears to be working (despite being obvious).
Please cease using my moniker at least until that has been fixed. Preferably, cease using it at all, especially while you're bitching about a company using your initials, when you know damn well the Android Package isn't named after you and more than the NSA is named after Norman Stanley Alexander.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
That thing doesn't look like DRM. It is a way for people to download play store apps from outside the play store, and still have the guarantee that they get the original. There is absolutely no mention of any restriction on the user. The signature can be stripped off and unsigned apps can still be installed if you check the "unknown sources" option.
What will happen in the future is another subject. Google needs more than a simple signature in order to lock down the system.
Also, Android already has DRM ( https://developer.android.com/... ).
Cryptographically signing applications to ensure integrity and authenticity may be a good idea (as long as phone owners retain the option, existing today, of installing apps from other sources if they wish). This scheme has nothing to do with DRM (Digital Restrictions Management), which is a name for methods intended to prevent users from copying works which are protected by copyright. DRM is technology that's supposed to prevent users from copying content (movies, e-books, etc), or more generally enforce whatever restrictions the supplier would like to enforce. Since DRM generally prevents users from doing things they would otherwise be able to legally do (make fair use of portions of the works; make backup copies; copy works in the public domain etc) it is justifiably considered a bad thing. I suspect that putting the DRM moniker on this possibly beneficial technology is motivated by encouraging users to think of DRM as something that protects their rights instead of something that violates them.
Do you not see irony in the fact that you've become what you hate? You're no different than the in-your-face, cram-their-shit-down-people's-throats, difficult-to-avoid, and hostile marketers that you so despise (and have accused my of being one of in the past). You literally get in people's faces, cram your shit down out throats, persist when people tell you they're not interested, and approach us all in the most hostile way possible; and it doesn't matter what your reason is, nor whether the reason is legitimate or simply perceived, what matters is the very behaviors you are exhibiting are the very behaviors those of us who block ads with to avoid.
So, why would we use a piece of software written by an advertiser to block ads?
The simple answer is that those of us who are sane would not. And we will not. That bridge burned the moment you started spamming and the crossing was dug wider when you started attacking people who pointed it out.
What makes me sad about this is that, one day, you'll stop. And when you do, we won't have a way to know whether it was because you finally sought treatment, were committed, killed yourself, were killed, or if you finally realized the irony in your actions.
At this point, the only way I would say your software was worth a damn is if it were also miraculously able to block your posts here on Slashdot. If that happened, honestly, that would make it the best fucking piece of software ever written. Of course, the advertiser only ever wants to block everyone else's ads, and never their own.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Google has introduced a small change to Play Store apps that could significantly protect several Android users.
What the fuck is with this weaselly bullshit advertising?
This part here. This one. This is the part that you need to focus on: "your phone will run a version of Android that won't be able to install apps without it."
This is the part you should be mad about. That's control. By a monolithic corporation that does not have your best interest at heart.
And the article itself is talking out of it's ass and throwing around doublespeak willy nilly. Observe:
DRM means you are being treated like a thief before you buy any software.
EA doesn't trust that we paid for the software title so it forces us to present our papers when demanded.
and every other entertainment publisher which decides where in the world you are allowed to listen to music or watch a movie that you paid for, or how many times you are allowed to do so.
Yeah, that's right, DRM is bad. Abusive. Annoying. A bad stance to have with the business-customer relationship. We're all on the same page. ....And then it does some mental gymnastics and says this:
So DRM is bad to the core. But not really. DRM is simply a way for a developer or publisher to keep track of software versions and authenticity.
. . . wtf? That's EXACTLY what those examples above are doing. "Keep track of authenticity" as in "This is not an approved app, SO YOU CANNOT RUN IT". How can you possibly acknowledge the pitfalls of DRM and then immediately turn around and say Google is doing this for the right reasons? That's utter delusional fan-boy bullshit.
There is certainly potential for abuse there, but we have to wait and see if any developers get any bad ideas.
No we don't. We've been to this rodeo before. And it's NOT the developers we have teo worry about. It's Google decided to flip on the walled garden bit of disallowing people to install what applications they want.
It's like how a knife in the back certainly has potential for worry. But we'll have to wait and see if google twists it on the way out.
You CAN'T HANDLE your own stinking privacy.
Only this is the Jack from The Shining and not the Jack from A Few Good Men.
(Or perhaps the Apple store is Jack from The Witches of Eastwick; none of Cher, Susan Sarandon, or Michelle Pfeiffer are dating Jared, so in that sense, at least, he got off light.)
Odd...I was taught these very things by an accountant.
I object to power without constructive purpose. --Spock
Imagine starting off for vacation. A little bell goes off telling you there is a flat tire. Do you not go on vacation? Do you call a man to get your family back on the road? Jesus fucking Christ.
I object to power without constructive purpose. --Spock
https://www.androidpolice.com/...
Thank you for proving my point.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Yes, and now that my perspective has changed I see that it is the work of an abject madman. Or do you not change your opinions as new facts arise?
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
(No changing facts written in stone long ago...)
No, just opinions written in bits.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Dude, when the hell did you find the time to write the Linux version? Seems like you're here posting this shit 24/7.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
I have a permit to carry weapons, but I am treated like an idiot who doesn't own my phone.google Nazi play store can sniff through my phone like pigs they are.time for a change sooner the later.to all idiots who need protection come to me I sell u bunch of story's to make u feel safer.