• onlinepersona@programming.dev
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    1 day ago

    As one Google Play Store customer said: “No consent given, install could not be paused or stopped. I watched it install itself on my phone on January 22, 2025 (couldn’t pause or cancel it) AND it did all of that over mobile network (my settings are to never download or install anything unless I’m on Wi-Fi). Description tells you nothing. Permissions are for virtually EVERYTHING.”

    However, some have reported that SafetyCore reinstalled itself during system updates or through Google Play Services, even after uninstalling the service. If this happens, you’ll need to uninstall SafetyCore again, which is annoying.

    I’ve said that this is possible multiple times and people have straight up to me “you don’t understand how android security works - this is impossible”. Well, here we are…

    Anti Commercial-AI license

  • nul9o9@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    2 days ago

    I have pictures of my kids doing silly things in the tub. This is gonna be fun.

  • Kbobabob@lemmy.world
    link
    fedilink
    English
    arrow-up
    0
    arrow-down
    1
    ·
    edit-2
    1 day ago

    Seems like a huge nothingburger

    GrapheneOS — an Android security developer — provides some comfort, that SafetyCore “doesn’t provide client-side scanning used to report things to Google or anyone else. It provides on-device machine learning models usable by applications to classify content as being spam, scams, malware, etc. This allows apps to check content locally without sharing it with a service and mark it with warnings for users.”

  • CubitOom@infosec.pub
    link
    fedilink
    English
    arrow-up
    0
    ·
    edit-2
    11 hours ago

    Edit: I suggest using obtainium so that if the app gets any new releases or updates you can easily get notifications and manage that. I also originally submitted a bad json code snippet which I have corrected and tested.

    After deleting googles safetycore, do the following to ensure Google doesn’t reinstall it.

    1. install the latest release of Obtainium
    1. Via Obtainium, install Safetycore-placeholder

    it might take some messing with Obtainiums settings to ensure that the latest version of the saftycore placeholder is installed so here is an export of my settings just for this app. Just copy the text and save it as a json to import the settings.

    {"apps":[{"id":"com.google.android.safetycore","url":"https://github.com/daboynb/Safetycore-placeholder","author":"daboynb","name":"com.google.android.safetycore","installedVersion":"v3.0","latestVersion":"v3.0","apkUrls":"[[\"Safetycore-placeholder.apk\",\"https://api.github.com/repos/daboynb/Safetycore-placeholder/releases/assets/232142109/"]]","otherAssetUrls":"[[\"v3.0.tar.gz\",\"https://api.github.com/repos/daboynb/Safetycore-placeholder/tarball/v3.0/"],[\"v3.0.zip\",\"https://api.github.com/repos/daboynb/Safetycore-placeholder/zipball/v3.0/"]]","preferredApkIndex":0,"additionalSettings":"{\"includePrereleases\":false,\"fallbackToOlderReleases\":false,\"filterReleaseTitlesByRegEx\":\"\",\"filterReleaseNotesByRegEx\":\"\",\"verifyLatestTag\":true,\"dontSortReleasesList\":false,\"useLatestAssetDateAsReleaseDate\":true,\"releaseTitleAsVersion\":true,\"trackOnly\":false,\"versionExtractionRegEx\":\"\",\"matchGroupToUse\":\"\",\"versionDetection\":false,\"releaseDateAsVersion\":false,\"useVersionCodeAsOSVersion\":true,\"apkFilterRegEx\":\"\",\"invertAPKFilter\":false,\"autoApkFilterByArch\":true,\"appName\":\"\",\"appAuthor\":\"\",\"shizukuPretendToBeGooglePlay\":false,\"allowInsecure\":false,\"exemptFromBackgroundUpdates\":false,\"skipUpdateNotifications\":false,\"about\":\"\",\"refreshBeforeDownload\":true}","lastUpdateCheck":1740803687541492,"pinned":false,"categories":[],"releaseDate":1740416435000000,"changeLog":"This release is signed, you need to uninstall the previuos version.","overrideSource":null,"allowIdChange":false}]}
    
    • CrayonRosary@lemmy.world
      link
      fedilink
      English
      arrow-up
      1
      ·
      edit-2
      24 hours ago

      This doesn’t load in Obtainium, and trying to validate the json gets the error below.

      It looks like the value should be a simple list of strings, but everything is escaped and it has double square brackets, and it’s enclosed in quotes.