• 0 Posts
  • 72 Comments
Joined 2 years ago
cake
Cake day: January 25th, 2024

help-circle





  • TLS handles security for the email sent from your device until it reaches the server, and various HIPAA compliance rules mandates security for that data once it reaches that server. It’s not alarmingly less secure than other HIPAA compliant methods of communication, unless the email provider on your end has poor support for TLS emails.

    Editing to include the disclaimer that this is for communications sent from your end. For communications sent from their end, this protection doesn’t necessarily apply (it depends on your email provider at that point, which may not be compliant), so for them to send you protected info via e-mail, they usually ask for your consent first, and usually the e-mail is just a link to a portal where you can access that information more securely.







  • You are likely thinking of google play protect, which does the same verification on their platform’s end (to try to remove bad actor developer accounts as soon as possible), and the local device end as well (to remove said developers apps if they are already installed on your device). But yes, at the base level, what arrives on your phone from the play store are just signed apk files. That’s why mirror sites like apkmirror or apkpure can do what they do, by extracting said apks after they have been released onto the play store.



  • tomalley8342@lemmy.worldtoAndroid@lemdro.idVerified developer
    link
    fedilink
    English
    arrow-up
    20
    ·
    2 months ago

    How is this going to be enforced if you are just downloading apks? It states they will enforce verification across sources outside of the play store. This doesn’t sound possible unless they just make stock android unable to side load

    apks will have to be cryptographically signed through Google’s developer console, and this signature will be checked by the operating system at install time regardless of where you got the apk from. It’s like how windows has signed applications for smartscreen, except in this case all applications must be signed through Google, and in order to sign it, you have to let Google know where you live, and unsigned applications will simply be denied instead of just being presented with a warning.


  • Well, until we abolish capitalism, that’s the state of things.

    I can see that things are the way things are. Accepting it is a different matter.

    Unless you feel like Nazis MUST be freely given access to everything too?

    To me, the “access” that I am referring to (the interface with which you gain access to a service) and that “access” (your behavior once you have gained access to a service) are different topics. The same distinction can be made with the concern over DoS attacks mentioned earlier in the thread. The user’s behavior of overwhelming a site’s traffic is the root concern, not the interface that the user is connecting with.