News for hackers. Stuff that matters.

A comment on Ask HN: How much is Google collecting and keeping on Android if not signed in?. Parent comment

Re:Ask HN: How much is Google collecting and keeping on Andr... by passerby1 on Sunday September 05, 2021 @02:20AM (#28422000)
> stay as far away from MicroG as possible, it seriouly cripples the security of GrapheneOS by a lot.

Do you mind sharing some details on this? I did not hear strong statements like this one before.

[ Parent | on HN ]
Re:Ask HN: How much is Google collecting and keeping on Andr... by 0xdeadb00f on Sunday September 05, 2021 @02:35AM (#28422053)
IIRC It requires allowing apps to mimic other app's signatures and pretend to be them, "signature spoofing". MicroG mimics the Google play services signature.

But that is really crippling, because apps can now spoof other apps signatures, essentially apps can pretend to be other apps. That opens a lot of opportunities for an attacker.

[ Parent | on HN ]
Re:Ask HN: How much is Google collecting and keeping on Andr... by bnr on Sunday September 05, 2021 @03:26AM (#28422245)
With the set of patches used eg in lineageos4microg, spoofing is restricted to the microG core app.
[ Parent | on HN ]
Re:Ask HN: How much is Google collecting and keeping on Andr... by 0xdeadb00f on Sunday September 05, 2021 @05:02AM (#28422651)
You're still taking a risk. its a risk that I won't take but you're welcome to for the sake of convenience.
[ Parent | on HN ]