7
apps .. repo or not (m.krbonne.net)
submitted 3 months ago* (last edited 3 months ago) by kristoff@infosec.pub to c/cybersecurity@infosec.pub

Hi all,

Interesting problem. An open-source project gets their app removed from google play, so they post a message on mastodon that -for the time being- you can download the app via direct download.

I post a reply saying that directing people to a direct link is not a good idea, as hackers could start doing the same to spread malwhere, better use an official repo (like f-droid, where they are already on).

A typical problem of somebody who writes a genuine post, but without realising it himself writes something that is very close to what a phishing message would look like.

However, this got me thinking. What you want to avoid is that people get used to the idea that it is OK to download and install apps from a random URL. But if you point people to f-droid, they need to also download the apk for that, and configure the security on your phone that apk's downloaded via may be installed.

I guess, the later should surely be avoided as most people will then leave that option enabled. (I had to search deep into the security setting to find the option to switch it off again).

What are your opinions on this? What would be the best way to do this and not teach people bad security habbits?

Direct download or f-droid? Other ideas? Is there a good sollution for this?

Kr.

you are viewing a single comment's thread
view the rest of the comments
[-] jaredj@infosec.pub 2 points 2 months ago

A name I've seen in connection with this issue is Obtainium. From a cursory look, it appears this just streamlines checking for and getting apk's from GitHub release pages and other project-specific sources, rather than adding any trust. So maybe it just greases the slippery slope :)

Security guidelines for mobile phones, and therefore policies enforced by large organizations (think Bring-Your-Own-Device), are likely to say that one may only install apps from the platform-provided official source, such as the Play Store for Android or the Apple App Store for iOS. You might say it's an institutionalized form of "put[ting] too much trust in claims of authority." Or you might say that it's a formal cession of the job of establishing software trustworthiness to the platform vendors, at the mere expense of agency for users on those platforms.

People are not taught how to verify the authenticity and legitimacy of software

Rant: Mobile computing as we know it is founded on the rounding off of the rough corner of user agency, in order to reduce the amount users need to know in order to be successful, and to provide the assurances other players need, such as device vendors, employers, banks, advertisers, governments, and copyright holders. See The Coming War on General Computation, Cory Doctorow, 2011. Within such a framework, the user is not a trustworthy party, so the user's opinion of authenticity and legitimacy, however well informed, doesn't matter.

[-] kristoff@infosec.pub 2 points 2 months ago

Obtainium seems to have a very interesting take on this. Thanks for the link! I will check it out ๐Ÿ‘

this post was submitted on 20 Aug 2024
7 points (100.0% liked)

cybersecurity

3257 readers
1 users here now

An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!

Community Rules

Enjoy!

founded 1 year ago
MODERATORS