> UA rotation is rarely used for legitimate purposes

It’s not uncommon for hundreds of users to share a single public IPv4 IP address through an ISP-provided NAT. The same applies to corporate LANs with a single uplink channel.

These users gonna have random UA corresponding to market share of web browsers and operating systems, all coming to the same web server from a single IP address.

I mean on the play store side, where they scan app submissions for TOS violations before they even hit the store. UA rotation on the client side is rarely used for good.

HTML requests are just text, how would you even go about scanning for that?

As from the blog post, the source is public[0] and the Android review process is almost entirely automated static/dynamic analysis of apps submitted, so it wouldn't be super hard to find UA-like strings and have some elevated manual review if there are a lot of them (if they decided to implement this sort of abuse policy).

0: https://github.com/DrKLO/Telegram/blob/c1c2ebaf4690fd91c116d...

Google very likely only scans the input application, I'm not sure why you would bother with an automated system to detect a code repo for it when the majority of applications on the Play Store are closed-source and there's a low confidence if the builds are not repeatable.

Anyway, regardless of that it sounds like it would be easily defeated with the following C format string:

"%s-%s: %s/%s (%s) %s/%s %s/%s"

with argument list:

"User", "Agent", "Mozilla", "5.0", "X11; Ubuntu; Linux x86_64", "Gecko", "2010000", "Firefox", "90.0"

For bonus points you can make those floating points, too, and split it up a bit further. Now nobody can scan for this without a lot of false positives (The strings are going to display in anything that embeds a web browser or references it, lol) and you get ultimate flexibility.

Why would they? This is the Google Play Store, not the Apple App Store with all its inane rules.

I think that’s only possible if they ban TCP/IP for play store apps, enforce that in the OS kernel (SELinux can probably do), and instead expose the one and only high-level HTTP API for apps.

These days Google isn't up to much on a technical level ;-)

They cannot even fix the old verbatim feature that they broke a few years ago, so how should should they be able to stop this without breaking something else?

Yep, this is somewhat hyperbolic but I'll write it anyway. I want my old Google back.

Tools -> All Results -> Verbatim is confirmed broken? I thought something was fishy...

Hasn't worked consistently for me for years.

To be precise: I think it work sometimes, but I know it doesn't work most of the time unless verbatim means something completely different from what I think ;-)

You can verify this quickly by searching for something slight unusual or very specific, apply verbatim and verify that most of the results still doesn't contain your words.