Google bans self-updating Android apps, possibly including Facebook’s

Facebook end run around Google Play store followed by change in Google policy.

Read the whole story

 

[Elij17]

Thank Facebook for pointing out a potential security flaw, even though they didn't mean to.

 

[chewy106]

I've noticed Zynga games seem to do this on both Android and iOS platforms. Not sure what's up with that...

 

[CrookedKnight]

(Ignore me! I am wrong.)

 

[jbrodkin]

CrookedKnight[/url]":2sgxaeo8]This would also affect the Amazon Appstore application. I just got an update pushed to that without the Play Store's intervention this morning.

No, because the Amazon Appstore isn't installed from Google Play to begin with (at least it wasn't when I installed it). This would only apply to apps installed from Google Play, and then updated outside Google Play.

 

[Barret]

CrookedKnight[/url]":id8sce3v]This would also affect the Amazon Appstore application. I just got an update pushed to that without the Play Store's intervention this morning.

Since the Amazon Appstore isn't from google's store there is no need for them to follow this policy

 

[jackstrop]

jbrodkin[/url]":uilx928x]

CrookedKnight[/url]":uilx928x]This would also affect the Amazon Appstore application. I just got an update pushed to that without the Play Store's intervention this morning.

No, because the Amazon Appstore isn't installed from Google Play to begin with (at least it wasn't when I installed it). This would only apply to apps installed from Google Play, and then updated outside Google Play.

Beat me to it.

 

[CrookedKnight]

I beat you both to it! Sort of. Totally forgot the Appstore isn't on Play at all.

 

[BMR-777]

Elij17[/url]":3kxz2rsz]Thank Facebook for pointing out a potential security flaw, even though they didn't mean to.

One man's security flaw is another man's "feature". Same thing goes for all of those "flaws" in iOS which allow it to be jailbroken.

 

[Sechul]

Nova Launcher does this, it gives users the option to install beta versions that haven't been uploaded to the Play Store. It isn't an auto update though, the user has to install manually. Wonder if that will matter

 

[bskin]

Sechul[/url]":34gbu1cz]Nova Launcher does this, it gives users the option to install beta versions that haven't been uploaded to the Play Store. It isn't an auto update though, the user has to install manually. Wonder if that will matter

Facebook isn't an auto-update, either.

 

[bskin]

I'm glad. I'm not sure why, but I'm really uncomfortable with the way Facebook started doing this. Maybe because I don't like how it would nag me every time I look at facebook, or maybe because I like being able to control my settings for app updates in one place. And maybe just because I'm afraid that one day the update they push to me will be for Home, which I explicitly am not interested in.

 

[griggle]

I am more interested in how they will enforce it? Do they know someone is doing it. Can they prevent it?

 

[daemonios]

Since Android already allows users to install apps from third-party sources, I agree with this move 100%. The potential risks are there and I can't see any reason why an app installed through Play would need to update outside of this framework.

 

[Xavin]

I am more interested in how they will enforce it? Do they know someone is doing it. Can they prevent it?

They can probably scan for it automatically, but more importantly it gives them cause for pulling apps that break the rule.

 

[daemonios]

griggle[/url]":3n0lxsd2]I am more interested in how they will enforce it? Do they know someone is doing it. Can they prevent it?

They can ban the app from Google Play for violation of its terms of service. Sure, anyone can publish Android apps, but they lose the advantage of being in the largest app marketplace for Android. And they lose the potential market of people who know nothing about authorizing third-party sources for apps.

 

[ClownRazer]

Edit: I've been corrected below, so nevermind!

 

[Toleraen]

...it's easy to imagine the creator of a malicious application enticing users with a seemingly legit app and then updating it with malware. No one expects Facebook to do that...

Maybe I haven't had my morning coffee, but I absolutely would expect Facebook to throw some garbage in like that. I love seeing my GPS fire up every time I launch FB, even though I've disabled location services within the app.

 

[RGMBill]

chewy106[/url]":1iluw78r]I've noticed Zynga games seem to do this on both Android and iOS platforms. Not sure what's up with that...

Is Zynga who I should blame for the crapware that's been getting installed on my phone, my wife's phone, and her tablet (but not mine) overnight? Last night was something like "2020: My Country" or some such. Woke her up when it installed itself without our permission.

 

[Shudder]

fferitt25[/url]":2iai9yqf]
Google Chrome on iOS does this same shit. Do what we say - not what we do huh ?

I find it hard to believe it does the same thing. But I don't use iOS anymore so I can't say for certain.

I'm glad Google is taking a harder stance against this. I uninstalled the FB app because of this mess. Not only do I disagree with how they went about it, in usual Facebook fashion they screwed it up. They said it would "only update over wifi" but my super-hot phone in a not so great 3G area that was constantly trying to download this, killing my battery, says otherwise.

 

[jbrodkin]

fferitt25[/url]":2jmbpn7f]

About six weeks ago, users of Facebook's Android application noticed that they were being asked to install a new version—without going to the Google Play app store.

Google Chrome on iOS does this same shit. Do what we say - not what we do huh ?


Wow. Has Google banned it's own Apps from auto-updating ?

Because the version number of my copy of Chrome keeps going up on various devices. And I get annoying notifications on my mobile devices constantly until i upgrade.

Chrome on iOS is updated through the Apple App Store.

 

[heartburnkid]

griggle[/url]":1gfdi7vn]I am more interested in how they will enforce it? Do they know someone is doing it. Can they prevent it?

Considering it's a Play Store guideline, and they control the Play Store, they most certainly can enforce it. If nothing else, they can take the app down after user complaints.

 

[daemonios]

fferitt25[/url]":27flcuhw]
Google Chrome on iOS does this same shit. Do what we say - not what we do huh ?


Wow. Has Google banned it's own Apps from auto-updating ?

Because the version number of my copy of Chrome keeps going up on various devices. And I get annoying notifications on my mobile devices constantly until i upgrade.

You really are a troll... Can't speak for iOS but others have confirmed Chrome updates through the App Store. And on Android I can definitely say every Google app updates through Google Play.

 

[Xavin]

Wow. Has Google banned it's own Apps from auto-updating ?

The only Google android app that auto-updates is Play. Some of the others will notify you of a new version, but they send you through Play to actually update it. That's the key, there's really no benefit to bypassing Play for updates unless you plan on doing something nefarious.

 

[Brass2TheMax]

Elij17[/url]":3um27cpk]Thank Facebook for pointing out a potential security flaw, even though they didn't mean to.

And by rights, thank Google for responding to it in the proper fashion, and promptly at that.

 

[Greho]

jbrodkin[/url]":2m2loefv]

fferitt25[/url]":2m2loefv]

About six weeks ago, users of Facebook's Android application noticed that they were being asked to install a new version—without going to the Google Play app store.

Google Chrome on iOS does this same shit. Do what we say - not what we do huh ?


Wow. Has Google banned it's own Apps from auto-updating ?

Because the version number of my copy of Chrome keeps going up on various devices. And I get annoying notifications on my mobile devices constantly until i upgrade.

Chrome on iOS is updated through the Apple App Store.

Chrome on iOS will nag you when there is an update available, but other apps do that, as well.

If you tap to update, you are sent to the Apple Store app, and the usual update procedure applies.

 

[adronbudows]

This seems reasonable.
I think that this can protect users, and keep all the apps automatically updating.
Allowing applications to bypass the play store messes with the whole idea. It's like Motorola sending you a new cable box without telling the cable company.

Note that it doesn't restrict app developers from offering other application as apks...

An app downloaded from Google Play may not modify, replace or update its own APK binary code using any method other than Google Play's update mechanism.

This feasibly opens the door to apps offering 'app beta' that install alongside (since it's a 'separate app' it seems like it could work under the current rules.

 

[Brass2TheMax]

ClownRazer[/url]":26xevni0]Yeah, this would allow an app to change the permissions that were initially used and indicated in the play store and basically let it do whatever it wanted, without warning, unless you had another app that monitored system access.

This doesn't really apply to FB though, I'm pretty sure it already requires nearly ever permission available anyway.

This is utterly incorrect, you're obviously not an Android developer. Likewise for the people who upvoted this.

If you install an app, be it from the Play Store or some third-party source, if a new version is released, one of two things are going to happen when you go to install the updated app:

1) Android recognizes that the new app is replacing the old one, sees that the permissions in the manifest have changed, and will prompt you if you want to continue with the installation while providing you with the break down of what permissions it's now asking you for that it didn't before.

2) The app isn't recognized as the same app at all, and Android will prompt you if you want to install it, while giving you a break down of all the permissions it is requesting.

Any way you cut it, you're going to be notified of permissions changes. There is no way that an app simply downloaded and executed for installation is going to be able to grant itself access to permissions it didn't have before, even if it were pre-installed but with less permissions in the "old" version.

Get your facts straight. And people, don't upvote things that aren't true. Keep in mind the information above *does not cover* hacks, workarounds (if any exist), or the like, because that's outside of the scope of what we're talking about.

 

[swertz]

Kudos to Google for locking this down, though it's too bad they waited for a high profile app to recognize the need.

Next up: how about asking Facebook to explain why latest update to the FB app requires "New permissions to set up Facebook Messenger and Facebook Home, which you can install separately". I have no interest in further endangering my privacy by installing those separate apps, so why does the app that I already have require new permissions now? Fishy-ness....

 

[zarmanto]

daemonios[/url]":3g3gkdmk]... Can't speak for iOS but others have confirmed Chrome updates through the App Store. ...

It sounds to me like some people are misunderstanding the issue... I expect the violation of this new policy only occurs when an app downloaded from Google Play performs the update without routing the user back to Google Play. The confusing interface element is most likely that of merely notifying a user from the app that the app is in need of updating, prior to routing the user to the Google Play (or Apple App Store) app; I expect this notification would not be in violation.

(But then, it seems that while I was typing, I was beaten to the punchline by more concise posters... )

 

[tombraun]

I've also been holding off updating the new FB app since they started doing all this. They are way too sneaky and invasive as is, whatever privacy-violating new 'features' they're trying to sneak onto my phone now, I don't want 'em.

 

[cvarner]

tombraun[/url]":1brsns14]I've also been holding off updating the new FB app since they started doing all this. They are way too sneaky and invasive as is, whatever privacy-violating new 'features' they're trying to sneak onto my phone now, I don't want 'em.

I generally hold off on updating FB as long as humanly possible. I rarely appreciate the changes they so lovingly cram down my throat.

The title here seems a bit off, though, as many commenters have misunderstood. It's not that apps can't self-update, exactly - they just have to do it through the Play mechanism, and only when that's how they were installed in the first place, right?

 

[ClownRazer]

Brass2TheMax[/url]":qiu4j34o]

ClownRazer[/url]":qiu4j34o]Yeah, this would allow an app to change the permissions that were initially used and indicated in the play store and basically let it do whatever it wanted, without warning, unless you had another app that monitored system access.

This is utterly incorrect, you're obviously not an Android developer. Likewise for the people who upvoted this.

Get your facts straight. And people, don't upvote things that aren't true. Keep in mind the information above *does not cover* hacks, workarounds (if any exist), or the like, because that's outside of the scope of what we're talking about.

Thanks for correcting me, and the thread. But IMO you could try to be a little less harsh -- this is a friendly place and there's always something to be learned. I could be misreading tone into your post that isn't there post but here's my revised opening for your post that I believe leaves less room for tonal misinterpretation:

"You're mistaken. I'm an android developer and can confirm that when an app, regardless of source, is installed etc..."

When you're trying to assert the truth, you don't need to wield it like a weapon -- at least not on the first pass.

 

[nurst]

Curious if this will affect antivirus products like Avast, which sometimes download definition and engine updates out-of-band from the Google Play store... A contributing factor, though one that Google may oppose, is that some of these vendors offer advanced features (like firewall capabilites) for rooted phones.. I have to wonder if that is part of the reason why these companies update their products this way.

 

[Oletros]

nurst[/url]":82r0rzzi]Curious if this will affect antivirus products like Avast, which sometimes download definition and engine updates out-of-band from the Google Play store... A contributing factor, though one that Google may oppose, is that some of these vendors offer advanced features (like firewall capabilites) for rooted phones.. I have to wonder if that is part of the reason why these companies update their products this way.

No, it doesn't apply, like it doesn't apply to apps that download additional data.

 

[VideoGameTech]

Just my viewpoint, but this sounds like a more explicit statement of an existing policy. The user knows the app will update but does not know the update is from someplace outside Play, hence causing "users to unknowingly download or install applications from sources outside of Google Play."

Also suspect that if their regular app got away with this, Home would have done the same thing in its next version.

 

[Ars of Ares]

Does this mean Plants vs. Zombies will stop running that stupid update check before loading?

 

[rothgar]

Why are you blaming Facebook and not the 32 malicious apps that started as legitimate apps and ended up being malware after they were automatically updated?
https://blog.lookout.com/blog/2013/04/1 ... ogle-play/