On non-rooted Android 17, ADB uninstall of system apps fails
github.com201 points by microtonal 15 hours ago
201 points by microtonal 15 hours ago
I don't understand why ensuring general-purpose computing is not a priority of the European Union.
All that talk about sovereignty, and we are giving full control of our digital lives to 2 American companies.
Because the EU wants attestation for age verification, digital surveillance and censorship, not free software platforms that wont implement any of those.
EU does not want that.
Only a few politicians, some of whom happen to be currently in power, in the EU or elsewhere, are pushing for those agendas. But fortunately, they do not represent the majority.
Bank account register, EUDI Wallet, Chat Control, digital Euro… They might not be the majority but they manage to go through with all of this.
If the majority is unable to do anything then their opposition doesn't really matter.
lobbyist from the usual american companies are convincing "politicians" to sponsor those bills.
This.
These things wouldn't go away if the EU or a company within the EU would provide a phone OS.
They would just serve different masters.
Well that was the original android phone idea. Get a hackable open device that you can write apps for your self. Even attach third party hardware to it for extra functionality with lots of customisation. But this idea has mutated quite a bit.
Even by 2015 the noise in Google was “the Chrome OS model is better” with reference to them centrally controlling everything.
Andy Rubin was no saint, on so many levels, but when he was removed from Android leadership and the Chrome culture effectively took over this was always how it was going to go.
I fully agree with it. But I think Google also understands that the platform is unatractive for businesses. In my case I just don't do Android app because I know it is easy to just take and hack. It is not the case on iPhone. And my app is one time payment so the ability to just copy out the APK leaves me not doing an app at all...
The people that go through the trouble of installing apks from random websites to not pay $1 are in the minority. What's more, most of them wouldn't pay that dollar if they couldn't find the cracked apk. So the only thing you're realistically doing is cutting yourself off of a huge market. Convenience sells, the Play Store does that
$1 - most probably. What about $20?
Unless your target market is a small niche of hackers, then yeah the vast majority would pay $20.
Just look at how many pay for music and video streaming services, when it's trivial to download anything for free from illicit sources.
> I know it is easy to just take and hack
No you don't, otherwise we wouldn't have banking apps on it.
It is a bit different. My app doesn't rely on 3rd party services at all. It just provides functionality. It is not about breaking into someones account.
I just know that the app can just be cracked - there are plenty of sites that do that for android. Because you can't just load your app on iOS - this is just not possible (well perhaps there are a few percent of some jailbroken iPhones, but that is neglibile).
On Android though, you can soon see such app stolen and on some of the apk warez sites. It just breaks the model.
> On Android though, you can soon see such app stolen and on some of the apk warez sites. It just breaks the model.
Think about Windows and software privacy
The only difference between iOS and Android when it comes to loading code onto your device is that, on iOS:
- You have to setup a developer account with Apple first, and dev-signed apps can only be installed onto specific provisioned devices only[0]
- The free tier of that developer account is inconvenient for actually using dev-signed apps as a daily-driver, and won't let you use certain entitlements
- Apple's dev tooling is designed to make it feel like you can only sign code you're compiling yourself
On the surface level, this might seem like a big difference, because Android has a command that lets you load arbitrary APKs with no particular fanfare or ceremony, while Apple's dev signer is buried inside of a compiler/IDE suite. But people have built tools to make it easy to take an arbitrary .ipa, sign it using your dev account, and resign it once the free tier's 7 day limit expires.
Of course, this still requires you actually go and obtain an .ipa of the app you want to use, and Apple distributes App Store[1] app binaries[2] encrypted. That part requires actually having a jailbroken device to dump the app binary with. But once the app is cracked anyone can install it.
If you want an actual "uncrackable" app you need to put a critical part of your app's workflow onto a server, and then have your app send an iOS DeviceCheck or Google Play Integrity attestation that the phone is running the actual App Store/Google Play version of your app. But that's also incredibly draconian behavior towards your customers as it basically forces your app to be always-online... which is why a disturbingly high number of games do this.
[0] Yes, I know about Enterprise signing, but Apple specifically forbids distributing Enterprise-signed apps outside of your organization and those apps get revoked all the time. Signing with your own dev account is way more robust and that's what most iOS power users actually use.
[1] I have no clue if FairPlay encryption applies to EU-DMA-compliance signed apps.
[2] ONLY binaries - all your resources are unencrypted and can be downloaded off the App Store CDN and inspected by anyone. Code signing signatures do apply to resources, AFAIK
> Because you can't just load your app on iOS - this is just not possible (well perhaps there are a few percent of some jailbroken iPhones, but that is neglibile).
No, smart normies are sideloading with the 7-day limit and leveraging automation to have their pirated apps automatically re-sign and re-push. If you pay the $99 to Apple for a dev cert (or like $10 to a service that'll sell you a cert off someone's account), it'll even just sign out for the year for you. No screwing with Xcode or anything, just drag-drop-sign. Even gives you the options to patch the app out at resigning so you can do hacks and mods like the good old jailbreak days.
Have you tried extracting, decompiling, and modifying someone else's app?
It wasn't hard before LLMs and it's nearly trivial now.
Is that not possible with ios applications?
You can't sideload iOS applications. Meaning there's no point to doing any of the listed things.
Of course you can. How do you think developers test their apps?
Never did iOS development. I always assumed it requires active USB connection with a dev machine or an emulator.
Normal people can't. I'd bet more people run jailbroken than bothering with developer-mode sideload.
The crypographic flow that allows payments to work is straight up pub/priv key encryption with one time use tokens. It's not something you can hack. As soon you see the token it's already been used and thrown away. So whatever nonsense about decompiling literally doesn't matter.
So your professional opinion is that the attack surface of mobile banking apps is limited to tokenized payments? Honestly, I'd be appalled if tokens were routed through my banking app. There is no reason the local client needs that data.
My professional opinion is that APKs can be de-compiled regardless and that has nothing to do with tokenized payments themselves which are like you said handled through server-server communications at the payment processor level. Your phone simply sends a one time use token to authorize the transaction.
You were the one that brought up payments though. Nobody else specified. They just said it could be hacked, which you seem to agree with.