Post #2615690

2025-08-26 05:38 UTC

@Gargron@mastodon.social the review process at Google can be a PITA, but for a good reason. Permissions to access more than an app really needs can be exploited for harvesting private information on a seemless update that most won't even notice. Side loaded apps downloaded from say APK mirror can have been tampered with using smali edits and you won't know. What Google should do is certified dev signing keys to trace and confirm if an APK is legit or not and coming from the actual dev, regardless of being side loaded.

Replies (2)

@Chickerino@tech.lgbt 2025-08-26 05:42

@denzilferreira@techhub.social @Gargron@mastodon.social so why dont we do this on windows or linux then, both oses by default dont even have a permissions system and give applications near full access to the device

Open ##2615691
@david_chisnall@infosec.exchange 2025-08-26 09:14

@denzilferreira@techhub.social @Gargron@mastodon.social Except that, it doesn't prevent malware. Note that this news article is from today. I went to find the most recent example of this and it turns out that I didn't even have to go back as far as yesterday. Proper safety is done by reducing kernel attack surface, reducing the size of the TCB, and making it easy for applications to respect the principle of least privilege so that ones that don't stand out as things that obviously request more permissions than they should have.

Open ##3064061