Hacker News Reader

Comment by badRNG | Hacker News Reader

Couldn't they just patch out that check?

Depends where the check is... most likely outside of the app itself. A regular phone with google play services already has a "backdoor" of sorts where google can push any code they want to you... which they have already used for dubious purposes like forcefully uninstalling certain apps from devices under the guise of security.

Revanced gives the app a new app ID (app.revanced.android.youtube) and resigns it, so Google cannot for example just check that apps using the youtube app id have a valid MD5.

They could check for Revanced and friends too though, probably even dual-purpose that to disallow installing it entirely since it wouldn't be allowed on the play store in the first place.

>They could check for Revanced and friends too though

Not really, at least not at the app ID level, because revanced can change app ids indefinitely. Google generally only solves a problem when it can be automated, and manually adding revanced app ids to a blacklist cannot easily be automated. In fact, since revanced is patched on device, they could assign each user a unique app id which would make using app ids as a solution unworkable for Google.

You don't think they know how to automate downloading the latest Revanced and checking the app ID?

Like I just said, you do not download a revanced youtube apk. You download a revanced patcher that patches the APK on your device. Right now, the patcher gives each app the same id, but theoretically it could give a random string as the app id that is generated by the user at runtime while patching, so that would not work. Even if that were not the case, Google would not set up a script to download latest revanced to check the id. It's only a few steps away from being manual because it would not work for other projects or even for revanced itself if they changed the website's code or domain name. What I mean by solving a problem with automation is like how Google detects copyrighted music in youtube videos and sends the ad revenue to the copyright owners.[0] Having someone constantly fix a script that "automates" finding app ids does not meet that bar.

[0] https://support.google.com/youtube/answer/2797370?sjid=13102...

The Play Store functions as a type of backdoor which allows them to run any code on your device that they want, which includes scanning for Revanced (regardless of the actual app ID, they could just look for the NAME of the app for example) and removing it.

They have already used the play store in the past to delete apps from people's devices: https://android.stackexchange.com/questions/252066/does-goog...

Why couldn't revanced generate a random app name? Also, I am not arguing that Google cannot find some way to block revanced specifically. I am arguing that they will not do so based on the way they generally handle these issues. If they really wanted to block revanced, the easiest way would be to validate that the user is signed in and that the connected account has a subscription to youtube premium. I have no idea why they don't do that already. In any case they definitely would not starting checking the app's "android:label" value against a list of disallowed app names.

I think they probably could but I am unsure of the implementation details.

Patching out the check might work for now, since they will be supporting older versions of the app for a while.

If they eventually decide that the server needs to verify the check, it might need to be spoofed rather than removed which can be more difficult (again, depending on implementation details).

Reply on news.ycombinator.com