Google launches new security features to protect users from unverified apps

[otp124]

I like the forced UX of typing something, though "continue" might be glossed over. It would be an interesting study to determine if typing "I know the risk" is a better safety mechanism for users (can be A/B tested for less pass-through events) than "continue".

[askvictor]

Typing something unique (eg the name of the app) might also be useful as it forces some cognitive processing.

[amelius]

I'm guessing yes, because users are more likely to abort the installation process.

[philo23]

I'm not sure I'm a fan of the way Google is re-using the Chrome error page styling for this, but I can't put my finger on why exactly...

[Spivak]

Because it blurs the line between a web page and the browser chrome. Any web page that attempts to look like the browser should be considered malware.

[martin-adams]

Because you associate it with an error that you have no control over? I find that I'm tuned to recognise patterns of behaviour, so when the patterns look similar to other things, but aren't the same, it's quite confusing.

[noway421]

G-Suite and Chrome are different products, so yes, It's perfectly reasonable to expect them to be separate.

[ComodoHacker]

I just can't shrug off the thought that manual review approach is a lost game in the long run. It's a process than requires skilled human and can't be fully automated while generating malicious code perfectly can.

[ebiester]

I think of it in a different perspective: You combine humans and programmers to do better than each could do alone.

Start all-manual. Perhaps you only do it with a subsection of applications. Pay an extra fee and you get "certified" with special app placement. Then you start all-manual. You look for the people who are the best at finding issues, and pair them with programmers, and make the tools for the things that are gruntwork for them.

Build more and more tools, and you pull more and more people into the program as you build more and more intelligence into the machine.

Let the humans do the NP-hard portions. I'm sure this is what Apple has to be doing behind the scenes.

[eterm]

Tasks of classifying things (in this case into "approved" or "rejected") that humans can routinely do but machines find difficult are areas where ML shines.

Human reviewers today, but once the training set is large enough you can start to let computers take over with human reviewers reviewing the lower certainty cases until the certainties rise further.

[londons_explore]

But making legit apps does take human effort.

If an app takes days to make, requiring 5 minutes extra review effort to get it whitelisted seems fine.

[hari_seldon_]

They already do manual review for many of their high-serving ads, and people shouldn't shy away from some human intervention in these processes.

AI and machine learning are most effective these days when they help assist people (flagging potentially malicious code, bubbling up anomalies, etc.), and it isn't that expensive to get a pair of eyeballs to double check conclusions!

[richardknop]

It actually can be automated to a quite some degree. This is basically a something called expert system. You could create automated system to do these reviews from human reviewers and their expert domain knowledge. It might never be 100% accurate and might require human intervention from time to time but a high level of automation of this process can be achieved.

[cptskippy]

Current Machine Learning techniques rely on being trained by manually generated data. Google's virtual Assistant learned to understand voice because Google setup Google 411 and had millions of participants train it. Google developed OCR models by setting up Google reCAPTCHA and having millions of people train it.

Manual prompts to users are a great way to develop training data and being able to distribute them at scale to millions of users means you can develop training data in very short order.

[ocdtrekkie]

On the contrary, the lack of human review is why both the Play Store and the Chrome Web Store (especially this one) are dumpster fires with rampant malware.

Automated tasks are not good at outsmarting humans. When you want to review a human's work for security, you need humans somewhere along the process.

Automation can help those humans do their jobs, but it's simply not a solution here.

[ameister14]

You don't need to be that skilled, do you? Isn't this something you can train thousands of people to do over the course of a couple months?

[pietroalbini]

Does this also appear on websites only using Google OAuth for authentication, requesting only the email address?

[eeveewoofwoof]

No, it doesn't appear for email/basic profile scopes.

[Walf]

But they still don't let you create app-specific passwords/tokens without enabling 2FA. How they think enabling "less secure apps" is better is beyond me. Trying to force an office full of luddites into 2FA does not go down well.

[pkamb]

> Type Continue to go to example.com

User types "continue"

[pbhjpbhj]

More like "malware app that user installed to type continue at all such prompts types 'continue'".

[mrkrabo]

In case you don't feel like clicking, this doesn't concern Android apps, but OAuth apps that want access to your Google account.

[kyrra]

It's also worth noting that this likely would stop phishing attacks like the one that happened earlier this year.

https://www.theverge.com/2017/5/3/15534768/google-docs-phish...

https://news.ycombinator.com/item?id=14258918

[dovdovdov]

I used up my 1 click effort coupon to get here to the comments, so thank you!

[rallycarre]

No point 0Auth apps if google has access to it. Rather pay for my e-mail service than to use google, whose source of revenue is directly in conflict with my interest of privacy and security.

I highly recommend protonemail.com. Has all the bells and whistles and its major feature is user privacy and security.

[paradite]

I see that you don't use ProtonMail often.

[cft]

Google has become the judge, the jury and the executioner of the internet. Recently a malicious user embedded an image from a site that is on Google's Safe Browsing list in a forum that is itself embedded on a third party site. This nuked a popular third party site where the forum is embedded: it is now flashing red (malicious software detected) in Chrome.

[adtac]

I was wondering how HN would spin this into Evil-Google. It's just tiring at this point. This is a perfectly valid security guard that protects their users.

[andruby]

Which site?