Sean Hollister

He answers immediately and confidently every time, often addressing the jury when he explains a concept.

“If we removed those consent screens, more users would be harmed and that would hurt security at Android,” he says of the Unknown Sources sideloading process.

From the RAW MEETING NOTES earlier:

On why Google disclosed the bug publicly before 90 days:

“It is common in security research teams to disclose vulnerability information after the vulnerability is fixed,” so that others can learn from it and contribute to security research that protects others later.

Won’t say I told you so, but then, why did Google move to a 90-days-no-matter-what timeline in 2020?

(As a reporter, I can tell you that reporters are tipped off all the time about all sorts of things, but that good reporters only chase worthy stories and don’t let companies steer them.)

But in the taskforce’s meeting notes, Google decided to reveal the bug far earlier:

They also discussed putting “three friendlies on it” (presumably three reporters or news outlets deemed “friendly” to Google) or passing the story to Lookout (presumably the mobile security company that often publicizes bug disclosures).

This all sounds shady on its face, but won’t Google just point out that the bug was fixed and the 90 days was no longer required? (In 2020, Google’s Project Zero team decided to start disclosing at 90 days regardless of fix status.)

DaveK is Android security head Dave Kleidermacher, Sameer is VP Sameer Samat, and JamieK is Google’s product manager in contact with Epic Games.

It wasn’t long before a member of the Android security team suggested that perhaps Google should make this public:

“(A Project Zero style external bug would be the most fun!),” they wrote.

We’re now seeing notes from the internal meeting where Google discussed what to do about it.

Kleidermacher says Google doesn’t take such things into account for Unknown Sources, though. Again, it’s an operating system level flag.

Now we’re talking about Google Play Protect, which automatically scans apps for malware. It’s recently been getting better at blocking malicious apps but didn’t block predatory loan apps and some knockoff apps in a TechCrunch test.

I don’t know if Epic’s sticking the landing here with so few visceral examples of bad apps (we saw just two user reviews calling out a scam, and the title S-ON Sexual Therapy), but Kleidermacher did amusingly suggest that Google allows users to download the bad apps without warnings because of user consent.

“There is user consent in one place, there is not user consent in the other place,” he said.

Epic pounced — how could a user’s decision to download an app from a website not constitute consent? Kleidermacher suggested the consent comes as part of Unknown Sources: “You’d have to authorize the browser to install first.”