all 38 comments

sorted by: hot top controversial new old
[–] 145 points 2 years ago (2 children)

KDE Connect is also available through Google Play and most likely signed with a different key as the F-Droid Version. Since Play Protect checks the App signatures, it probably detected this discrepancy and determined the App was fake. Not really an Assholedesign as this is a valid concern if a normal user downloads an app from the internet.

  • source
  • hideshow 4 child comments
  • [–] 27 points 2 years ago (1 child)

    On the other hand it's a valid case to have the app installed by means other than the play store. I can't imagine they have found this discrepancy in signatures for the first time.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 years ago (1 child)

    Probably most other apps are correctly signed with the same certificate on both sites.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 2 years ago (1 child)

    No they are not: F-Droid builds a signs the apps independently. Source: I have apps on both stores.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 years ago

    You can actually sign the F-Droid app yourself, if you use reproducible builds.

    There's reasonable odds the signatures still won't match though, because Google requires App Bundles now, and then they build and sign the APK, rather than allowing the developer to build and sign their own APK.

    Technically you can use the same key (see "Best Practices" of this page), but it's kind of shady, and requires giving your private key to Google.

  • source
  • parent
  • [–] 7 points 2 years ago* (1 child)

    It could just ask before removing shit. Remove the permissions, freeze the app, prompt the user to confirm they meant to install it from somewhere other than the playstore. Hell, since it can detect F-Droid is installed, maybe use some context clues and ask the user to confirm this app was installed from there?

    More importantly, can you tell it to ignore certain apps? I don't know, I've had Play Protect turned off forever. If not, that's absolutely asshole design.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 60 points 2 years ago (1 child)

    Imagine doing a business if Google one day start to hate you.

    No listing on most popular and the only search engine that counts. Most popular browser gives a big red warning for your website. Even with different browser it won't connect due to Google being the most popular DNS provider. No app on the only widely used app store on Android - the only OS phone manufactures use besides Apple. Your app is automatically uninstalled on >99% Android phones. Your calls gets blocked by Android spam detector. Your e-mails get blocked by Gmail. And besides that, Google would pumps all of your competition up.

    That much power over the market is very dangerous and should not be legal.

  • source
  • hideshow 2 child comments
  • [–] 52 points 2 years ago (1 child)

    There was a similar thread where Play Protect blocked installation of Signal. As it turned out, said copy of Signal was indeed fake, as op downloaded it from F-Droid, where it's not being distributed.

    Maybe it's the same case here?

  • source
  • hideshow 2 child comments
  • [–] 9 points 2 years ago (1 child)

    Sad to see so many upvotes for bad information, no. Signal is a special case (it's their choice to disallow any open source client which they did not build) and does not follow the same rules.

    KDE Connect is hosted on Gitlab, advertises install from F-Droid and is just as real from F-Droid as it is from the Play Store. Play Protect routinely tries to save me from this other harmful app (their words not mine) called Squawker.

    Play Protect trying to incorrectly remove F-Droid apps is nothing new.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 2 years ago

    Then this is a KDE Connect issue. If they sign with different keys, they should use different app names (in the manifest, the visible name could still be the same). If two apps have the same identifier but are signed with different certs, Google is right to treat one of them as an impostor.

  • source
  • parent
  • [–] 32 points 2 years ago (1 child)

    This is why the Web Integrity API is terrifying to me.

  • source
  • hideshow 2 child comments
  • [–] 16 points 2 years ago (1 child)

    Yeah and imagine if Google decided they don't like your small business and ruins your livelihood overnight.

    In no time you'll lose your house to a bank, all because a company that you have little association with chose to.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 2 years ago*

    I can’t even imagine what pernicious elements they can add to it to bog down someone’s website too. They don’t even have to introduce it on purpose, if it’s just a byproduct they can shrug and not worry about it. It’s shocking how much traffic you lose if your website takes three seconds to load.

    Everyone should switch to Firefox/Mullvad

  • source
  • parent
  • [–] 30 points 2 years ago (3 children)

    Google and Amazon need broken up. Change my mind.

  • source
  • hideshow 6 child comments
  • [–] 22 points 2 years ago*
    • (open) play store
    • (tap) your profile picture
    • (open) Manage apps & device
    • (open) Google play protect
    • (tap) settings icon at the top
    • (disable) scan apps with play protect
    • congratulations, google will babysit us less than before
    • install kde connect again

    Optional:

    • send a hate email to google support but do not abuse the employee reading it, because he is probably under pressure 25h a day by google
  • source
  • [–] 17 points 2 years ago*

    Hilariously, Google Play Protect is one of the worst tools on Android at detecting malware and triggering false positives, and consistently scores poorly in independent tests like AV-Test and AV-Comparatives. You can find links to these tests on the AMTSO website.

  • source
  • [–] 14 points 2 years ago (1 child)

    Why would anyone enable Google Play Protect? You want them combing through your personal data with the ability to delete anything they disagree with?

  • source
  • hideshow 2 child comments
  • [–] 12 points 2 years ago*

    This is great design for the average user. Just bad for the power user

  • source
  • [+] 11 points 2 years ago* (last edited 1 year ago)
    [–] 10 points 2 years ago

    Not only did the same thing happen to me, now that I've disabled Play Protect and reinstalled it I'm having trouble getting it to re-pair with my PC. Thanks for fucking up my property, Google. 🖕

    Where's the Computer Fraud and Abuse Act when you need it?

  • source
  • [–] 6 points 2 years ago (2 children)

    Interesting. But should this apply to many apps on F-Droid? I also have an app published on both the Play Store and F-Droid and I don't recall having seen requests to change the application ID to avoid clashes between stores.

  • source
  • hideshow 4 child comments
  • [–] 11 points 2 years ago* (last edited 2 years ago)

    KDE Connect is likely a special case; as it is a PC integration app, and a very feature-loaded one at that, it accesses a whole bunch of sensitive stuff like notifications, clipboard, direct file access, SMS functions, keyboard inputs and more.

    More than any other non-root-accessing app, you do not want a trojanised version of KDE Connect on your phone.

  • source
  • parent
  • [–] 2 points 2 years ago (1 child)

    If the signature matches, Google probably won't care where they are installed from. I suspect that the KDE Connect in fdroid is signed with a different certificate than on google play, causing it to be flagged as an impostor. This could probably be easily prevented by using the same cert or different app identifiers (to cause them to be treated as different apps).

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 2 years ago

    And this is why Play Store is disabled on my device!

    Disabling just play protect works too, but it occasionally shows popups asking for it to be re-enabled ☹️

  • source
  • [–] 3 points 2 years ago

    GrapheneOS is the real answer.

  • source
  • [+] 3 points 2 years ago* (last edited 2 years ago) (1 child)
  • [–] -1 points 2 years ago (1 child)

    Oh woah. Can't let Google know what apps I have installed.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 11 points 2 years ago (1 child)

    It’s really a shame that that is even normalized. Why is it their business to know what apps are installed on a personal device? Just one more way to fingerprint users and advertise to them.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 2 years ago

    I remember arguing with a google fanboi about Google's diktat for Android apps to not have a shutdown button. He was waxing lyrical about how Google PBUH is all knowing and works in mysterious ways. I said google does this so that you can't turn off its spyware shit.

  • source
  • parent