News for hackers. Stuff that matters.

A comment on About backdoors in crypto messengers. Parent comment

Re:About backdoors in crypto messengers by larma on Thursday January 19, 2017 @07:14AM (#13435152)
Even with stock Android, on devices != Pixel or Nexus, Google parts are sandboxed in a way making it hard for them to access private app data. The only way would be to deliver a different app through play store which is easy to discover as it breaks the cryptographic signature and must be done on first install (android uses TOFU).

So without the mentioned issues through Play Services and Gboard, Google would not be able to access your Signal messages. On Stock Nexus/Pixel builds they can of course push updates that change this...

[ Parent | on HN ]
Re:About backdoors in crypto messengers by tokenizerrr on Thursday January 19, 2017 @07:37AM (#13435256)
They can patch the sandbox out in an update, right?
[ Parent | on HN ]
Re:About backdoors in crypto messengers by larma on Thursday January 19, 2017 @10:50AM (#13436690)
On Pixel and Nexus, yes. for every other device it would require coop with the device manufacturer: they build the open-source code (+ their own proprietary extensions), add google apps and libraries (that are sandboxed) and sign the build. Only they have the private keys to provide updates, Google does not have full device access.
[ Parent | on HN ]