> These companies somehow had their signing keys leaked to outsiders
I can dream, but I would love to know what this "somehow" is. Such a leak is a major security threat to a sizeable portion of phone users. Disclaiming what happened and what you are doing about it would be good.
Generally speaking I don't have much trust in anything a large company is building. In this case, this is very likely they haven't used an HSM for something at the root of the security for stuff like Samsung Pay... This is a major smell to me.
Multiple independent business units developing apps and needing to share the same signing key. Probably contracting out development to other firms.
Neither Google or Apple offer robust ways to effectively delegate App develop while retaining secrets needed to publish an App. So you effectively need a FTE managing and supporting all of these groups.
Can you do that for App/Play Store Apps? How does that work with companies that don't have offices. As a result of COVID, our org is permanently WFH and we shifted all of our datacenters to cloud providers.
not too long ago i belive there was a dump of samsung IP materials, and proprietary tech resources, if it wasnt there somehow, the method could have been in there.
I can dream, but I would love to know what this "somehow" is. Such a leak is a major security threat to a sizeable portion of phone users. Disclaiming what happened and what you are doing about it would be good.
Generally speaking I don't have much trust in anything a large company is building. In this case, this is very likely they haven't used an HSM for something at the root of the security for stuff like Samsung Pay... This is a major smell to me.