Droppers Is How Android Malware Keeps Sneaking into the Play Store

Re:Droppers Is How Android Malware Keeps Sneaking into the P... by nothrabannosir on Friday July 20, 2018 @09:11AM (#17574658)

Is it the responsibility of the app to display the file browser? I’m not an app developer but I’d expected you could essentially call “osGiveMeAFile(constraints...)”, and it would pop up a native file picker dialog without your app ever having access to the full FS?

Then again I wouldn’t be surprised if google had botched this. They did it wrong for Google Drive apps, and as a result any app that wants to do something as outlandish as, say, opening a file requires read access to all files on your entire google drive, just to display a file picker.

Sometimes I wonder if anyone at Google actually thinks about these things, like, at all. How does this happen? What are those meetings like? Surely someone noticed? Ho do they think about “trust”? It never ceases to amaze me.

[ Parent | on HN ]

Re:Droppers Is How Android Malware Keeps Sneaking into the P... by TeMPOraL on Friday July 20, 2018 @09:16AM (#17574684)

I agree. IMO, what should happen is: the app request for file(s), an isolated (as in, separate sandbox) file picker is shown to select those files, and only stream handles + metadata (size, file name without path) is returned.

[ Parent | on HN ]