7 ms·
The problem is easy to solve by making 99% of all apps normal apps that don't get any special privileges and don't require any developer certification, and havi
by jonathanstrange 3mo ago
The problem is easy to solve by making 99% of all apps normal apps that don't get any special privileges and don't require any developer certification, and having a certified developer program with heavily locked down run mode for the 1% of high security apps like banking and payment apps. It's not hard to attest unambiguously to the user in some way whether they are running one of these rare secure apps or a normal one, a restricted API suffices but you could also just add an LED for it.
You can't possibly convince me that Google couldn't develop something like that if they wanted to.
- IshKebab 3mo agoHow does Android know if an apk that nobody has ever seen before is a payment or banking app? You could probably restrict "risky" APIs like draw-over-other-apps, but tbh I think that would be a worse solution than just making people wait 24 hours once.
- gruez 3mo ago>and having a certified developer program with heavily locked down run mode for the 1% of high security apps like banking and payment apps. How do you determine/enforce whether an app is a "payment app" without a centralized developer program? They don't require any special privileges. After all, most banking apps have web equivalents.
- jonathanstrange 2mo agoYou need a centralized developer program but only for the apps for the secure enclave. The whole point is that they would require special privileges.