Fortnite, Security, and Monopoly

Epic Games appears to be planning on distributing Fortnite for Android outside of the Play Store.

Frankly, I’m surprised that it took this long for somebody to do this. For a firm with their own payments and software distribution infrastructure, Google’s 30% cut is going to seem awfully steep. For strong brands, the lost sales from people unwilling to go through the alternative installation process may be lower than the 30% losses incurred through Google Play distribution. The only reason why Google can continue to charge 30% is due to the near-monopoly status of the Play Store on many Android devices.

The primary counterpoint to Epic’s decision is security. While one can obtain APKs from places other than the Play Store, conventional wisdom is that this is less secure. In particular, unwitting people might be tricked into installing malware that is disguised as Fortnite (or some other app of relevance).

Today, that conventional wisdom is likely to be true. And yet:

• Malware can be found on the Play Store. Google is not infallible.

• China lacks the Play Store. I had the opportunity to discuss app distribution with a manager from a large Chinese Android device manufacturer, and he expressed incredulity when I explained that Western developers often only ship their apps through the Play Store. In China, there are dozens, if not hundreds, of app stores, all competing for attention. Developers there are used to distributing their apps through many different channels. I have no evidence that users are routinely pwned as a result. Perhaps we can learn a bit from how they are handling this situation.

• Play Protect and third-party security products can analyze APKs installed from elsewhere. The Play Store’s internal analyzers are not our sole line of defense, even today, nor should they be.

• We are headed towards a world where a significant percentage of Android developers delegate app signing to Google. This allows Google to do whatever it wants with the contents of APKs… and it allows others to direct Google to do whatever they want with the contents of APKs. Quis custodiet ipsos custodes? We assume that Google is always a good actor with respect to app distribution – will that assumption hold up?

We definitely need more robust options for helping users identify what sources of APKs are safe. We definitely need more robust options for helping users safely install such APKs. We definitely need more ways to help users and developers ensure that the APKs that users install really are the APKs that the developers distribute. Perhaps Epic could contribute some towards such efforts, as they would gain PR benefits against those who accuse them of actively harming the Android ecosystem.

But, in general and IMHO, those who endorse monopoly in exchange for a little security are causing strategic harm to user security, as much as Epic is causing tactical harm to user security.