Hacker News Reader

Comment by qwertox | Hacker News Reader

I have an Android app which I developed just for me. I use it to record bike rides, see weather forecasts, see who called on the landline and the like. It's not published nor uploaded to Google Play or elsewhere, because it is just for me.

When I upgraded it today to a new version, my Pixel phone told me that I have to upload the app to Google, so that they can security-check it. Previously there was an option where you could select something like "don't check".

It's somehow the same as with this Adobe issue. Google now has a copy of my app even though I just installed my app on my phone.

If now a Google employee installs the app on a device to "check" it, he will be able to see my power consumption, see who called, listen to voice messages, and so on.

View on HN

Are you referring to this: https://support.google.com/android/answer/2812853 If so, do the directions mentioned there help?

The situation you are describing is not morally the same. (edit: striking through this part ~~Adobe's desire for their customers' content is to use it to develop AI tools that Adobe can then resell to its customers.~~) The security checkup you are talking about is intended to combat a real problem that unsophisticated smartphone users are victim to.

Adobe's request to access your content is not based out of intending to safeguard unsophisticated users.

Imagine if Microsoft had to sign off on every single program you write for your own windows box in the name of privacy and safety. It certainly does feel like we're moving in that direction, really.

Microsoft already does something closely similar with Defender. For years. All your files are uploaded to Microsoft cloud automatically, if the file checksum is not in the Defenders database.

It is even very difficult to disable. It always gets back on after a while, unless you do some serious PowerShell magic.

https://medium.com/sensorfu/how-my-application-ran-away-and-...

I would bet the TOS allows AI training (to detect vulnerabilities). But I would imagine off-label use is possible too.

> he will be able to see my power consumption, see who called, listen to voice messages, and so on

So is your API key baked into the app? Implement a login screen or a field for the API key and then who cares if Google has a copy of your app, they can't access your data.

There is no API key. The URLs are not public, not guessable, and traffic runs over HTTPS. Any attempt at accessing a wrongly guessed URL bans the IP address. I have no intention to rewrite this stuff.

You need to have the app to get to know the URLs.

Randomly generated url (even by a bad random generator like a human) is equivalent to an API key. Your exact same argument you made about the url can be made about a baked in API key.

Implement auth, do extremely basic auth if you have to using http basic auth over https and check against a hardcoded value on the server, it's not secure by any stretch of the imagination but is better than giving "api keys" to any intermediary that can do a string dump on your APK...

Interesting, I am doing exactly the same thing with GrapheneOS and never had a problem. If you have a Pixel, I would strongly recommend to consider Graphene a degoogling it. You can also install via Fdroid or Obtainium and I don't see how their apps could be supported in Google Play

I have multiple personal apps that I've side loaded on my Pixel Fold. This hasn't come up for me. Are you sure there isn't more to this story?

Absolutely sure. It's this "Google Play Protect"-feature. I have multiple apps, and they used to trigger randomly these scan requests on upgrades for maybe two years, but with today's install it appears that they have changed how they deal with this, where you no longer have a choice.

Maybe it's because it has extensive permissions wich I need in order to get access to my data usage, but that's not the point. Then again, it also happens with apps which don't require many permissions.

Reply on news.ycombinator.com