News for hackers. Stuff that matters.

A comment on Barcode scanner app on Google Play infects 10M users with one update. Parent comment

Re:Barcode scanner app on Google Play infects 10M users with... by ignoramous on Monday February 08, 2021 @05:09AM (#26062690)
Open source apps can absolutely have trackers in them. F-Droid isn't a security solution by any measure. I have inspected code of at least one popular "privacy" app that absolutely tracks its users out in the open (I mean, the code is right there on GitHub), yet I see repeatedly that app (and F-Droid) being touted as some elixir that fixes security and privacy for one and all. It doesn't. Don't place your trust on F-Droid apps blindly, and more importantly, refrain from blanket advocating F-Droid apps as a security / privacy panacea.

What I do instead is monitor Android's traffic with a LittleSnitch-esque firewall and block all apps I don't use. Also, I've disabled auto-updates on non-essential apps. Only Photos, Maps, Chrome, and Firefox are allowed to auto update on my Android.

[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by JeremyNT on Monday February 08, 2021 @08:14AM (#26063967)
Were the trackers already labeled in F-droid? They maintain a list of these anti features for all apps. If not, when you reported your findings to F-Droid, did they flag the app as having trackers at that time?

Nobody said blanket trust anything. F-Droid is a community project with a framework that allows for disclosing user hostile behavior in apps. By using it and paying attention, we can all make it even better - the exact opposite of Google, whose incentives do not align at all with these goals.

[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by marcodiego on Monday February 08, 2021 @06:43AM (#26063276)
F-droid flags apps that have known anti-features. Using Open source software is a very significant security solution.
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by epicide on Monday February 08, 2021 @10:57AM (#26066190)
(F)OSS by itself is not a security solution. Largely because you can't "solve" security.

There are plenty of insecure open source apps. To deny that would be to deny tons of security-related CVEs.

Yes, open source software is easier to audit, but does nothing to a) make those audits actually happen (frequently enough), nor b) improves the quality of those audits.

i.e. just because I have access to information does not validate that information. Work still has to be done.

[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by marcodiego on Monday February 08, 2021 @01:05PM (#26067897)
FLOSS may have security vulnerabilities, just like any other software. An OSS android app which has no anti-feature flags on f-droid with intrusive advertisements or malware behavior, deliberately implemented by its own developer, is something I have never heard about.

The same can't be said about 'free' (or sometimes even paid) proprietary apps from play store.

[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by krageon on Monday February 08, 2021 @05:13AM (#26062717)
It would be more compelling if you actually mentioned what app you've found that's so naughty.
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by higerordermap on Monday February 08, 2021 @07:01AM (#26063385)
It's manually curated and generally flags such things as anti-features if found, and I'd believe them more than some tensorflow_script_to_detect_malware.py
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by ignoramous on Monday February 08, 2021 @07:43AM (#26063705)
I wouldn't depend on F-Droid or FOSS as a measure of security. Of course, I get that F-Droid is run by volunteers, but I hope no one is spreading the notion that the F-Droid apps are magically uber secure and private or anything.
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by higerordermap on Monday February 08, 2021 @08:56AM (#26064456)
I wasn't clear. What I told was comparative.
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by rectang on Monday February 08, 2021 @06:25AM (#26063182)
What open source gives you is an audit trail, which is helpful but not sufficient. You still need to be able to trace malicious code to actual individuals. Then you need the ability to punish those individuals, ideally through criminal prosecution.
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by schmorptron on Monday February 08, 2021 @07:58AM (#26063829)
What app are you talking about specifically?
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by ignoramous on Monday February 08, 2021 @08:32AM (#26064168)
https://news.ycombinator.com/item?id=25492855 and https://news.ycombinator.com/item?id=25263876
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by You-Are-Right on Monday February 08, 2021 @09:14AM (#26064681)
why is nebulo not on fdroid?
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by ignoramous on Monday February 08, 2021 @09:27AM (#26064860)
It is on the main developer's f-droid repo: https://github.com/Ch4t4r/Nebulo#f-droid
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by You-Are-Right on Monday February 08, 2021 @03:05PM (#26069421)
I do like the fdroid review process - private repos do not have that.
[ Parent | on HN ]
Re:Barcode scanner app on Google Play infects 10M users with... by schmorptron on Monday February 08, 2021 @08:36AM (#26064213)
ah, thanks!
[ Parent | on HN ]