Hacker News Reader

Comment by liopleurodon | Hacker News Reader

Actually, it seems like they can delete it from devices. FTA it's just a push notification :(

Yep, they can. AFAIR this feature was used once in the past after a court order to delete an app that was very popular in south america (brazil?), but contained a nasty sideload.

I can't find an an article backing this up though.

Wait, really? That seems ... very unexpected. Can anyone confirm, ideally with some sort of proof, that Google can delete apps from your phone on demand?

I suppose Apple has this ability too. I've never really thought about it.

Given that I have to re-sign sideloaded open-source iPhone apps every 7 days for them to work, I would imagine that Apple could just revoke the app’s signing certificate and it wouldn’t launch. I don’t know how Android works in this regard.

Android apps, even on the Google Play store, are signed by the developer (not Google). Even with the new "app bundles", where you can give Google your signing key so they can make downloaded apps only include the code needed on that device (languages, screen size, etc.), you still have access to that key as far as I know and can sign apps with it.

I don't have proof but I believe they can.

AFAIK this has only been used when they detected abuse from an app, not for because an app has been banned, but the capability is there

Why would this be unexpected? You can buy apps on Play. You can also cancel your purchase 5 minutes later. In that case it stands to reason that Google would want to have a way to remove the app from your device.

I think I can help provide some proof.

First - the article talks about the message delivery via push notification. The push notification is, essentially, a JSON object.

The relevant notification for push/delete would be something like:

  notificationType: 2
  docid {
    backendDocId: "com.zhiliaoapp.musically"
  }

Second - ADB itself, of course, provides a command for removal of an app. Only requirement would be permissions. If working direction with a console on target device, that command is going to look like this [1]:

  pm uninstall -k --user 0 [package name]

Third - Google playstore has the permissions required to read and write to the phones filesystem. I can't find this explicitly stated, but I'm sure someone else will link to some documentation showing this is true.

Fourth - Kinda makes everything else a moot point, google play apps are served by google clouds (the author mentions this as well), so even if google couldn't remove the app from the phone, it could essentially cut the cords to the APIs and render the app useless. [2]

1 - https://jimcofer.com/2019/02/18/uninstalling-android-apps-vi...

2 - https://developer.android.com/guide/playcore/dynamic-deliver...

Final thoughts: The author touches on this, but I don't think anyone really knows the answer. Google can remove TikTok, but will they (they haven't yet, right? lol)?

EDIT: formatting and final thought

> The push notification is, essentially, a JSON object.

It’s a proto message, to be more precise.

They can install an app and similarly they can remove them, and they did it already many times, for example https://www.techrepublic.com/blog/smartphones/google-deletes...

Reply on news.ycombinator.com