Google launches new security features to protect users from unverified apps

https://techcrunch.com/2017/07/18/google-launches-new-security-features-to-protect-users-from-unverified-apps/

by workerthread • 9 years ago

155 58 9 years ago

mrkrabo• 9 years ago

In case you don't feel like clicking, this doesn't concern Android apps, but OAuth apps that want access to your Google account.

dovdovdov• 9 years ago

I used up my 1 click effort coupon to get here to the comments, so thank you!

kyrra• 9 years ago

It's also worth noting that this likely would stop phishing attacks like the one that happened earlier this year.

https://www.theverge.com/2017/5/3/15534768/google-docs-phish...

https://news.ycombinator.com/item?id=14258918

TomAnthony2• 9 years ago

I reported a bug to Google just a couple of days, which is very similar to this.

It allows an attack to present a user with a real Google 'account select' page with their account listed, but if they click that link it actually redirects them to another site (which you can dress up to look like the password page the user is expecting).

It is arguably worse than the previous issue, as I don't need a hoax extension, I can just manipulate the link to inject the malicious redirect behaviour.

They have triaged it and I'll probably write up a report once they are happy for me to do so.

pietroalbini2• 9 years ago

Does this also appear on websites only using Google OAuth for authentication, requesting only the email address?

eeveewoofwoof• 9 years ago

No, it doesn't appear for email/basic profile scopes.

akuji1993• 9 years ago

Thanks for that info, if it's setup like this it doesn't affect me at all instead of being really annoying to work with (since most of my apps are still in development).

pietroalbini2• 9 years ago

Thank you, one less thing to worry about!

cft• 9 years ago

Google has become the judge, the jury and the executioner of the internet. Recently a malicious user embedded an image from a site that is on Google's Safe Browsing list in a forum that is itself embedded on a third party site. This nuked a popular third party site where the forum is embedded: it is now flashing red (malicious software detected) in Chrome.

adtac• 9 years ago

I was wondering how HN would spin this into Evil-Google. It's just tiring at this point. This is a perfectly valid security guard that protects their users.

DanielBMarkham• 9 years ago

It is, and with Google in a position of owning much of what happens online, it's also Google acting unilaterally in ways that multiple actors might not.

Both statements are true: It's a good thing. It's not right to have one company with so much power

No evil Google required.

blojayble• 9 years ago

Where does this attitude stem from anyway?

bjpbakker3• 9 years ago

This is a perfectly valid security guard that protects their users

No it's not. It's Google telling it's users which apps to use and not to use. For regular users Google presents itself (just like Apple does) as an authority of what's a good app. Any other apps automatically are not good in the mind of regular users.

andruby• 9 years ago

Which site?

otp124• 9 years ago

I like the forced UX of typing something, though "continue" might be glossed over. It would be an interesting study to determine if typing "I know the risk" is a better safety mechanism for users (can be A/B tested for less pass-through events) than "continue".

amelius• 9 years ago

I'm guessing yes, because users are more likely to abort the installation process.

askvictor2• 9 years ago

Typing something unique (eg the name of the app) might also be useful as it forces some cognitive processing.

Moru• 9 years ago

Or "I allow LeetHaxorApp to access all my data"

But I guess that is a bit too much typing for most people.

philo23• 9 years ago

I'm not sure I'm a fan of the way Google is re-using the Chrome error page styling for this, but I can't put my finger on why exactly...

martin-adams• 9 years ago

Because you associate it with an error that you have no control over? I find that I'm tuned to recognise patterns of behaviour, so when the patterns look similar to other things, but aren't the same, it's quite confusing.

samtoday• 9 years ago

It is literally training users to dismiss these kind of errors. In Chrome, these errors are really bad, like a safebrowsing warning or a TLS error.

On the other hand, this warning will probably happen a lot! Is Google going to be able to "validate" apps fast enough?

noway421• 9 years ago

G-Suite and Chrome are different products, so yes, It's perfectly reasonable to expect them to be separate.

Spivak• 9 years ago

Because it blurs the line between a web page and the browser chrome. Any web page that attempts to look like the browser should be considered malware.

ComodoHacker2• 9 years ago

I just can't shrug off the thought that manual review approach is a lost game in the long run. It's a process than requires skilled human and can't be fully automated while generating malicious code perfectly can.

londons_explore• 9 years ago

But making legit apps does take human effort.

If an app takes days to make, requiring 5 minutes extra review effort to get it whitelisted seems fine.

yjftsjthsd-h• 9 years ago

Only if similar numbers of people work on each side. With thousands or millions of developers to a handful of reviewers, it may go as well as Google's other attempts at human support (read: terrible).

eterm• 9 years ago

Tasks of classifying things (in this case into "approved" or "rejected") that humans can routinely do but machines find difficult are areas where ML shines.

Human reviewers today, but once the training set is large enough you can start to let computers take over with human reviewers reviewing the lower certainty cases until the certainties rise further.

ComodoHacker2• 9 years ago

I bet we first hear about ML shining at generating malicious code obfuscated as legit.

ameister14• 9 years ago

You don't need to be that skilled, do you? Isn't this something you can train thousands of people to do over the course of a couple months?

ebiester• 9 years ago

I think of it in a different perspective: You combine humans and programmers to do better than each could do alone.

Start all-manual. Perhaps you only do it with a subsection of applications. Pay an extra fee and you get "certified" with special app placement. Then you start all-manual. You look for the people who are the best at finding issues, and pair them with programmers, and make the tools for the things that are gruntwork for them.

Build more and more tools, and you pull more and more people into the program as you build more and more intelligence into the machine.

Let the humans do the NP-hard portions. I'm sure this is what Apple has to be doing behind the scenes.

richardknop• 9 years ago

It actually can be automated to a quite some degree. This is basically a something called expert system. You could create automated system to do these reviews from human reviewers and their expert domain knowledge. It might never be 100% accurate and might require human intervention from time to time but a high level of automation of this process can be achieved.

cptskippy• 9 years ago

Current Machine Learning techniques rely on being trained by manually generated data. Google's virtual Assistant learned to understand voice because Google setup Google 411 and had millions of participants train it. Google developed OCR models by setting up Google reCAPTCHA and having millions of people train it.

Manual prompts to users are a great way to develop training data and being able to distribute them at scale to millions of users means you can develop training data in very short order.

ocdtrekkie• 9 years ago

On the contrary, the lack of human review is why both the Play Store and the Chrome Web Store (especially this one) are dumpster fires with rampant malware.

Automated tasks are not good at outsmarting humans. When you want to review a human's work for security, you need humans somewhere along the process.

Automation can help those humans do their jobs, but it's simply not a solution here.

hari_seldon_• 9 years ago

They already do manual review for many of their high-serving ads, and people shouldn't shy away from some human intervention in these processes.

AI and machine learning are most effective these days when they help assist people (flagging potentially malicious code, bubbling up anomalies, etc.), and it isn't that expensive to get a pair of eyeballs to double check conclusions!

tracker1• 9 years ago

I'd love to see an ad system with manual review for all ads... and have a review fee when ads are changed/cycled.

rallycarre• 9 years ago

No point 0Auth apps if google has access to it. Rather pay for my e-mail service than to use google, whose source of revenue is directly in conflict with my interest of privacy and security.

I highly recommend protonemail.com. Has all the bells and whistles and its major feature is user privacy and security.

paradite• 9 years ago

I see that you don't use ProtonMail often.

pkamb• 9 years ago

Type Continue to go to example.com

User types "continue"

pbhjpbhj• 9 years ago

More like "malware app that user installed to type continue at all such prompts types 'continue'".

Walf• 9 years ago

But they still don't let you create app-specific passwords/tokens without enabling 2FA. How they think enabling "less secure apps" is better is beyond me. Trying to force an office full of luddites into 2FA does not go down well.

Google launches new security features to protect users from unverified apps

Related Stories