2

Apple App Store allows publishing update to an application even when certificate lost and recreated but Google Play Store does not allow it.

Using same bundle id is fine for publishing an update of application to Apple App Store, so a new certificate could be used while publishing the update of the application.

So, why Google Play Store does not allow it? Is it a security weakness to allow it? Or Google Play Store is exaggerating about security and unnecessarily require same certificate?

Apple App Store allows it

But Google Play Store does not allow it

Community
  • 1
  • 1
lockedscope
  • 965
  • 17
  • 45

2 Answers2

1

It has little to do with the Play Store. Android does not allow it, for security reasons. Malware authors would love the ability to replace an existing app with their malware-injected replacement. Requiring a matching signature is one of the ways that Android prevents this.

CommonsWare
  • 986,068
  • 189
  • 2,389
  • 2,491
0

It's simple, Apple Certificate can be generated only by the owner of the account (or the hacker who got access to it). Also if the certificate is revoked the owner will get an email on this matter => not a big problem for security.

For Android, anybody who has a little knowledge about Android, can generate a keystore, find the app package name, and there you go, he/she could upload an update to your app => huge security problems.

On the other hand, as a developer is your responsibility to generate these keys/certificates and deliver them to your client and specifiy to your client that they are really important and they should be stored in a safe place. That's how I roll :D

danypata
  • 9,895
  • 1
  • 31
  • 44
  • So, i understand that, only Apple issues the signing certificate but for Android, developer could generate signing certificate. Thus, as Apple is signing identity, we would be aware if our certificate is dropped. But, we would not be aware when a new certificate is used for Android. So, Android requires same certificate to be used to identify the app. – lockedscope Jun 29 '16 at 14:17
  • So, why does not Play Store used the same way as App Store and manage certificates on its own? – lockedscope Jun 29 '16 at 14:21
  • @lockedscope What you say is correct, but you have to take in consideration that there are two different signing processes, so there might be other hidden issues. Also, I think that Android is using combination between keystore SHA1 and package name to identify your app trough different platforms, such as Google Play & Google Console. – danypata Jun 29 '16 at 14:21
  • @lockedscope I'm not sure how many apps you developed on Android and iOS, but to be honest I love how Android is signing the apps. Easy and fast. I always keep the keystore in the repo, or send it via Eamil to my client and mark that mail important so I won't use it. iOS signing procedure, from my point of view it's a pain in the ass. – danypata Jun 29 '16 at 14:23
  • So, i am not considering the usability of certificate signing process. I want to know why does not Google Play Store used the same way as App Store and so get rid of using the same certificate for the updates of the app? – lockedscope Jun 29 '16 at 14:32
  • @lockedscope I think in order to answer your question, you'll have to dig a lot in the signing process of Google Play, and maybe send an email to google devs. – danypata Jun 29 '16 at 15:47