News for hackers. Stuff that matters.

A comment on Google Play Dumps APKs for the More Google-Controlled “Android App Bundle”. Parent comment

Re:Google Play Dumps APKs for the More Google-Controlled “An... by ehsankia on Friday July 02, 2021 @03:03PM (#27715449)
Is that true if you use code transparency signing key?

https://developer.android.com/guide/app-bundle/code-transpar...

[ Parent | on HN ]
Re:Google Play Dumps APKs for the More Google-Controlled “An... by Avamander on Friday July 02, 2021 @05:47PM (#27717346)
Yes.

> Important: The Android OS does not verify code transparency files at install time, and continues to rely on the APK signing schemes for verification of any installed APKs.

It's pretty much useless because no-fscking-body is going to build a service to gather signatures from a bunch of devices in hopes to catch Google in the act.

[ Parent | on HN ]