sohei

Can anyone with more expertise comment on the use of cryptography.hazmat which is apparently (1) a frontend to openssl, (2) "full of land mines, dragons, and dinosaurs with laser guns"?

How did you gather the comment histories? Would you mind sharing a copy?

This is the story people tell in business schools and economics departments, but there's more to it than that.

It's also a way to sterilize new issuance to employees, primarily senior management. In a very real sense, it can be a backdoor payment to management. Issue shares to management. Buy shares on the market. Net effect is cash to management.

If buybacks are funded by debt issuance, it's also a way to lever the company. Remember Apple and Carl Icahn? That particular episode looks a lot like greenmail. Apple bought back shares, mainly from Icahn, so that Icahn would go away. The buybacks weren't exclusively from Icahn, so it wasn't technically greenmail.

> ToS is the least of it

I'm afraid I disagree. Google running code on your phone implies it believes you have consented to that. That consent was not given in the app store, so it must have come from the ToS.

Consent is an exception to virtually every protection that exists: Wiretap Act, state wiretapping laws, the CFAA, and state computer trespass laws. Remember, consent is the difference between a home invasion and a dinner party.

So it seems that Google would have to cook up a pretty implausible stopping principle to argue that whatever allows them to do this does not also enable the hypothetical I described above.

Another question worth asking is "what is the governing law?" It is almost certainly contract law via Google's ToS. Government phones probably have different ToS, but government employee' personal phones have the same ToS we have.

If Google is asserting non-contractual rights, I'd like to know what they are.

Edit: I edited this comment because it was rude, and that was not my intent.

The factual basis of your assertion is absolutely true, but your attitude is unhelpful and defeatist.

There is a chasm between "a state actor throws an 0day at you" and "Google remotely installs an app on your phone". The latter is done at scale. The former is expensive, risky, and used relatively rarely.

If you're organizing a protest movement, it's totally reasonable to factor government 0days into your threat model. For more boring people, running GrapheneOS is a great way to reduce the attack surface they expose to the advertising and mass surveillance industrial complex.

A corollary of your question. If Google can lawfully install arbitrary apps on ordinary users' phones, can it also run arbitrary code on the personal devices of government officials investigating it for price fixing in the ad market?