I'm using android play store to download and update software for my phone. And some times its automatically updated as by settings.The play store is linked to one of my Gmail account. Here my question is that how can trust that I'm securely communicating to download and upgrade the software of my phone and also assure that the software downloaded using my account is 100% trusted and safety ?
Add a comment
|
1 Answer
The play store uses SSL/TLS to ensure the integrity of your downloads, just like your web browser. Basically it downloads metadata for a particular package including a plain HTTP URL and a checksum of the binary. After the download it compares the checksum to the APK and ensures they match.
how can trust that I'm securely communicating to download and upgrade the software
This gives you a reasonably strong assurance that the download hasn't been compromised during the communication process, however if the TLS can be compromised then the metadata request containing the download URL and checksum can be tampered with.
Compromising TLS wouldn't be trivial to most adversaries, however TLS depends on the integrity of the 150 root CA certificates installed on the device. Many of these trusted CA certificates are controlled by departments of various governments including the US and China. If your adversary has the resources of a nation state then there is a good chance they could compromise your downloads.
Also there is the potential for an attacker to trick the user into installing a malicious root CA certificate via social engineering techniques such as phishing. Android has reasonably strong defences against this though, including a warning in the notification bar whenever additional CA certificates are installed.
Another layer of defence is that certain permissions can only be accessed by APKs signed by the same certificate as the system. This provides additional protection for system Apps such as the settings App.
assure that the software downloaded using my account is 100% trusted and safety ?
What I've mentioned above ensures that your download is what you wanted to download. It does not guarantee that what you intended to download is trustworthy or safe. Google does some automated scanning of submissions for malicious functionality (they call this system "Bouncer"), however I'd only consider that a first line of defence.
In general you should apply the same discretion to Apps as you would to PC software.
- Only download from trustworthy vendors
- Check reviews and feedback
- Check permissions manually and thoroughly
- Don't install software you don't absolutely have to
Etc, etc.
Note: My answer is applicable to Android 4.4.4 and Play Store 4.9.13, however it most likely applies to newer versions too.
-
:Firstly thanks for providing more details. In this case, they are lot of possibility that my Gmail Id is identified by some other software vendors and they can send spam ? Commented Feb 28, 2015 at 23:41