Challenging Google Play Security: A Technical Proposal for Manifest-Level Verification

Proposal on Play Store security measures (alternative to Google’s mandatory “developer verification”)

Google’s mandatory developer verification focuses on identity rather than the technical vectors used by malicious actors to exfiltrate user data. The author argues that current Play Store policies fail to block apps like Telega, which can intercept chats via hardcoded MTProto proxy servers despite having verified legal entity status.

Why This Matters

Current security models rely on the reputation of the developer rather than the behavior of the binary. This creates a false sense of security where verified accounts can still deploy apps with embedded Man-in-the-Middle (MITM) certificates or hardcoded malicious endpoints that bypass standard CA trust stores. By shifting to a declaration-based model in the Android manifest, security scanners and Play Protect could programmatically detect suspicious data streams and facilitate more granular, run-time permission handling for network access.

Key Insights

• Mandatory declaration of public keys and certificates prevents apps from using embedded MITM keys to intercept traffic (Indigotime, 2026).
• Hardcoded web service addresses should be declared in the manifest to allow Google Safe Browsing to audit specific endpoints instead of granting generic internet permissions.
• The Telega app example demonstrates that verified legal entities can still publish clients with hardcoded proxies capable of reading user chats.
• Technical declarations enable antivirus and Play Protect to detect malicious patterns regardless of the app’s distribution source.
• Future Android versions could use these declarations to implement selective permission granting for specific network addresses.

Practical Applications

• Use Case: Play Store security scanning using declared manifest endpoints to cross-reference against Safe Browsing databases.
• Pitfall: Relying on generic ‘INTERNET’ permissions allows apps to exfiltrate data to any server without user or system visibility.
• Use Case: Implementing certificate pinning via manifest declaration to ensure the system only trusts specific keys for the app’s traffic.
• Pitfall: Using developer identity verification as a proxy for security allows sophisticated actors with clean IDs to distribute phishing tools.

References:

• https://dev.to/indigotime/proposal-on-play-store-security-measures-alternative-to-googles-mandatory-developer-1b24