Hacker News new | ask | show | jobs
by badRNG 638 days ago
Couldn't they just patch out that check?
2 comments

Depends where the check is... most likely outside of the app itself. A regular phone with google play services already has a "backdoor" of sorts where google can push any code they want to you... which they have already used for dubious purposes like forcefully uninstalling certain apps from devices under the guise of security.
Revanced gives the app a new app ID (app.revanced.android.youtube) and resigns it, so Google cannot for example just check that apps using the youtube app id have a valid MD5.
They could check for Revanced and friends too though, probably even dual-purpose that to disallow installing it entirely since it wouldn't be allowed on the play store in the first place.
>They could check for Revanced and friends too though

Not really, at least not at the app ID level, because revanced can change app ids indefinitely. Google generally only solves a problem when it can be automated, and manually adding revanced app ids to a blacklist cannot easily be automated. In fact, since revanced is patched on device, they could assign each user a unique app id which would make using app ids as a solution unworkable for Google.

You don't think they know how to automate downloading the latest Revanced and checking the app ID?
Like I just said, you do not download a revanced youtube apk. You download a revanced patcher that patches the APK on your device. Right now, the patcher gives each app the same id, but theoretically it could give a random string as the app id that is generated by the user at runtime while patching, so that would not work. Even if that were not the case, Google would not set up a script to download latest revanced to check the id. It's only a few steps away from being manual because it would not work for other projects or even for revanced itself if they changed the website's code or domain name. What I mean by solving a problem with automation is like how Google detects copyrighted music in youtube videos and sends the ad revenue to the copyright owners.[0] Having someone constantly fix a script that "automates" finding app ids does not meet that bar.

[0] https://support.google.com/youtube/answer/2797370?sjid=13102...

I think they probably could but I am unsure of the implementation details.

Patching out the check might work for now, since they will be supporting older versions of the app for a while.

If they eventually decide that the server needs to verify the check, it might need to be spoofed rather than removed which can be more difficult (again, depending on implementation details).