Hacker News Reader

Comment by Zhenya | Hacker News Reader

What if an app is sold and I don't trust the new developer?

Particularly, since app developers tend to be pretty abusive in terms of data collection, my default position is that any app dev cannot be trusted until they've proven otherwise.

This is my biggest concern. One of my favorite mobile games (high stakes, I know) was originally produced by a small indie dev with a strong privacy policy. A year or so ago they sold to Zynga. I've not updated the app since then because I don't want any Zynga apps on my phone. If this forces me to update to the privacy-invasive, user-hostile Zynga version, I'll have to uninstall one of my favorite games. :(

Does auto-update persist when authhor changes?

Yes, alas, same for iOS AFAIK. It's a flaw in the security/trust model of both platforms. Similarly, you'll be prompted for new permissions if a malicious new owner adds new permissions to the app, but nothing tells you it's a new owner so you will likely grant permissions without realising everything might have changed.

It's not really a flaw. Whether it is the same app or not is being distinguished by package name + signing key. If both versions are signed by the same key, for all intents and purposes the newer version is legit.

On Android, in offline scenario, the installer doesn't even know who is the author and whether it changed. Here, all it knows is the above: package name + key used to sign.

Seems like a flaw. E.G.:

https://www.androidpolice.com/2019/04/27/es-file-manager-van...

That sure sounds like a flaw to me.

Reply on news.ycombinator.com