We discussed a possibly security issue which occures because the Android design makes no difference between the installed applications.
Imagine the following situation:
You have a shopping application where you want to pay the bill using paypal. Your application maybe will start an intent who want to deal with the paypal payment. If you have a paypal application installed, this application will react on this intent and everything is fine.
What if you have a bad application installed which will also handle paypal but in the bad way? Well Android will ask you which application you want to use. Thats seems a good way to filter the bad application out.
But what if you haven’t installed the good paypal application? Right, Android won’t ask you and will start the bad application right away…
Ok, who will install a bad application on his phone? No one!
Now think about this way:
You install an application for navigation which also listen for paypal intents? You won’t notice that this application has this bad part inside.
What could be done against something like that?
Give some application unique intents? Bad “closed” idea.
Certificates for trusted usage?
Public-Private-Key stuff?
What ever, I think this is a security issue we will face sooner or later…
Please discuss with us…
