Beyond Google Play

Abstract

China is one of the largest Android markets in the world. As Chinese users cannot access Google Play to buy and install Android apps, a number of independent app stores have emerged and compete in the Chinese app market. Some of the Chinese app stores are pre-installed vendor-specific app markets (e.g., Huawei, Xiaomi and OPPO), whereas others are maintained by large tech companies (e.g., Baidu, Qihoo 360 and Tencent). The nature of these app stores and the content available through them vary greatly, including their trustworthiness and security guarantees.As of today, the research community has not studied the Chinese Android ecosystem in depth. To fill this gap, we present the first large-scale comparative study that covers more than 6 million Android apps downloaded from 16 Chinese app markets and Google Play. We focus our study on catalog similarity across app stores, their features, publishing dynamics, and the prevalence of various forms of misbehavior (including the presence of fake, cloned and malicious apps). Our findings also suggest heterogeneous developer behavior across app stores, in terms of code maintenance, use of third-party services, and so forth. Overall, Chinese app markets perform substantially worse when taking active measures to protect mobile users and legit developers from deceptive and abusive actors, showing a significantly higher prevalence of malware, fake, and cloned apps than Google Play. CCS CONCEPTS• Information systems → Web mining; • Security and privacy → Mobile and wireless security; • Networks → Mobile networks;

Does the Presence of Privacy Relevant Information Affect App Market Choice?

“…We suspect that participants are unlikely to switch to an app market with strong app security checks and transparent privacy dash boards, unless those features are easy to use, and there is a broad range of apps available. Indeed, HiAPK is the only market represented that does not check copyright, check apps, or perform security checks [12]. Yet, it is the second most used among the five specialised app markets (c.f.…”

“…Participants then indicated how likely they were to download an app given seven different criteria, which were chosen to reflect key differences between Chinese app markets as identified in [12]. Three of the seven criteria reflect curation (passed manual inspection, high quality rating, app is up to date), two provide relevant user data from the app market (high number of downloads, high average user rating), and the final two are properties of the app (contains in-app purchases, contains ads).…”

“…Since Google Play is not routinely installed on Chinese Android phones, dozens of alternative app markets have emerged. The biggest markets are typically maintained by established Internet companies, such as Baidu or Tencent, or by mobile phone manufacturers, such as Huawei and Xiaomi [13,12]. These app markets differ greatly in the information they present to users, the security and quality checks they conduct on the apps in their store, and the number of apps provided [12].…”

Before and after GDPR: tracking in mobile apps

“…As a consequence, the preamble of the GDPR explicitly states that it seeks to tackle the 'widespread public perception that there are significant risks to the protection of natural persons, in particular with regard to online activity' . Tracking is one such risk (Binns, Lyngs et al, 2018;Wang et al, 2018;Zimmeck et al, 2019), especially since US intelligence agencies can access the data troves of Google and other tech companies. These risks posed by US intelligence have recently made the European Court of Justice restrict the sending of personal data to the US, as part of its Schrems II judgement.…”

“…The collection of personal data via mobile apps by companies offering analytics, advertising, and other services, has been identified as a significant and ubiquitous threat to data protection and privacy in recent decades (Binns, Lyngs et al, 2018;Wang et al, 2018;Zimmeck et al, 2019). Unlike first-party tracking, where data is collected by the app developers themselves, such companies engage in 'third party tracking' where 'data regarding a particular user's activity across multiple distinct contexts' is retained, used or shared between those contexts (Doty et al (2019)).…”