[HN Gopher] Google details new 24-hour process to sideload unver...
___________________________________________________________________
Google details new 24-hour process to sideload unverified Android
apps
https://android-developers.googleblog.com/2026/03/android-de...
Author : 0xedb
Score : 369 points
Date : 2026-03-19 17:16 UTC (5 hours ago)
(HTM) web link (arstechnica.com)
(TXT) w3m dump (arstechnica.com)
| mzajc wrote:
| tl;dr:
|
| - You need to enable developer mode
|
| - You need to click through a few scare dialogs
|
| - You need to wait 24h once
|
| I wonder how long this will last before they lock it down
| further. There was a lot of pushback this time around and they
| still ended up increasing the temperature of the metaphorical
| boiling frog. It still seems like they're pushing towards the
| Apple model where those who don't want to self-dox and/or pay get
| a very limited key (what Google currently calls "limited
| distribution accounts").
| throwuxiytayq wrote:
| Will these measures eliminate fraud? Of course not. What a
| shame; I guess we'll need to lock down the platform even
| further.
|
| This is so overt.
| kykat wrote:
| I propose we ban all computing devices to prevent fraud and
| harm to children.
| notrealyme123 wrote:
| its so obvious what the real goal is. No sideloading. Period.
| But nice of them to show their intentions while still giving
| time to leave.
| tadfisher wrote:
| Honestly, _if coerced sideloading is a real attack vector_ , then
| this seems to be a pretty fair compromise.
|
| I just remain skeptical that this tactic is successful on modern
| Android, with all the settings and scare screens you need to go
| through in order to sideload an app and grant dangerous
| permissions.
|
| I expect scammers will move to pre-packaged software with a
| bundled ADB client for Windows/Mac, then the flow is "enable
| developer options" -> "enable usb debugging" -> "install malware
| and grant permissions with one click over ADB". People with
| laptops are more lucrative targets anyway.
| dfabulich wrote:
| I predict that they're going to introduce further restrictions,
| but I think the restrictions will only apply to certain
| powerful Android permissions.
|
| The use case they're trying to protect against is malware
| authors "coaching" users to install their app.
|
| In November, they specifically called out anonymous malware
| apps with the permission to intercept text messages and phone
| calls (circumventing two-factor authentication).
| https://android-developers.googleblog.com/2025/11/android-de...
|
| After today's announced policy goes into effect, it will be
| easier to coach users to install a Progressive Web App
| ("Installable Web Apps") than it will be to coach users to
| sideload a native Android app, even if the Android app has no
| permissions to do anything more than what an Installable Web
| App can do: make basic HTTPS requests and store some app-local
| data. (99% of apps need no more permissions than that!)
|
| I think Google believes it should be easy to install a web app.
| It should be just as easy to sideload a native app with limited
| permissions. But it should be very hard/expensive for a malware
| author to _anonymously_ distribute an app with the permission
| to intercept texts and calls.
| yjftsjthsd-h wrote:
| > But it should be very hard/expensive for a malware author
| to anonymously distribute an app with the permission to
| intercept texts and calls.
|
| And how hard/expensive should it be for the developer of a
| legitimate F/OSS app to intercept calls/texts?
| Tostino wrote:
| Yep, I have a legitimate use case for exactly this. It
| integrates directly with my application and gives it native
| phone capabilities that are unavailable if I were to use a
| VoIP provider of any kind.
| dfabulich wrote:
| As a legitimate developer developing an app with the
| power to take over the phone, I think it's appropriate to
| ask you to verify your identity. It should be an
| affordable one-time verification process.
|
| This should not be required for apps that do HTTPS
| requests and store app-local data, like 99%+ of all apps,
| including 99% of F-Droid apps.
|
| But, in my opinion, the benefit of _anonymity_ to you is
| much smaller than the harm of anonymous malware authors
| coaching /coercing users to install phone-takeover apps.
|
| (I'm sure you and I won't agree about this; I bet you
| have a principled stand that you should be able to
| anonymously distribute malware phone-takeover apps
| because "I own my device," and so everyone must be
| vulnerable to being coerced to install malware under that
| ethical principle. It's a reasonable stance, but I don't
| share it, and I don't think most people share it.)
| Tostino wrote:
| I think you read a bit too much into my message. I agree,
| it's complicated, I don't want my parents and
| grandparents easily getting scammed.
|
| But yes they are my devices, and I should be able to do
| exactly what I want with them. If I'm forced to deal with
| other developers incredibly shitty decisions around how
| they treat VoIP numbers, guess who's going to have a
| stack of phones with cheap plans in the office instead of
| paying a VoIP provider...
|
| But no, I have no interest in actually distributing
| software like that further than than the phones sitting
| in my office.
| dfabulich wrote:
| For a security-sensitive permission like intercepting texts
| and calls, I'm not sure it makes sense for that to be
| _anonymous_ at all, not even for local development, not
| even for students /hobbyists.
|
| Getting someone to verify their identity before they have
| the permission to completely takeover my phone feels pretty
| reasonable to me. It should be a cheap, one-time process to
| verify your identity and develop an app with that much
| power.
|
| I can already hear the reply, "What a slippery slope!
| _First_ Google will make you verify identity for complete
| phone takeovers, but soon enough they 'll try to verify
| developer identity for _all_ apps. "
|
| But if I'm forced to choose between "any malware author can
| anonymously intercept texts and calls" or "only identified
| developers can do that, and maybe someday Google will go
| too far with it," I'm definitely picking the latter.
| tadfisher wrote:
| I don't think Google has a strategy around what should be
| easy for users to do. PWAs still lack native capabilities and
| are obviously shortcuts to Chrome, and Google pushes
| developers to Trusted Web Activities which need to be
| published on the Play Store or sideloaded.
|
| But these developer verification policies don't make any
| exceptions for permission-light apps, nor do they make it
| harder to sideload apps which request dangerous permissions,
| they just identify developers. I also suspect that making
| developer verification dependent on app manifest permissions
| opens up a bypass, as the package manager would need to check
| both on each update instead of just on first install.
| msl wrote:
| > Honestly, _if coerced sideloading is a real attack vector_ ,
| [...]
|
| I don't believe that it is. I follow this "scene" pretty
| closely, and that means I read about successful scams all the
| time. They happen in huge numbers. Yet I have never encountered
| a reliable report of one that utilized a "sideloaded"[1]
| malicious app. Not once. Phishing email messages and web sites,
| sure. This change will not help counter those, though.
|
| I don't even see what you could accomplish with a malicious app
| that you couldn't otherwise. I would certainly be interested to
| hear of any real world cases demonstrating the danger.
|
| [1] When I was a kid, this was called "installing."
| Stagnant wrote:
| This is the thing that bothers me the most about this. It is
| as if even the HN crowd is taking it as given that malware is
| this big problem for banking on Android but in reality there
| seems to be very little evidence to back this up. I regularly
| read local (Finnish) news stories about scams and they always
| seem to be about purely social engineering via whatsapp or
| the scammer calling their number and convincing the victim
| they are a banking official or police etc.
|
| That's why I'm inclined to believe Google is just using
| safety as an excuse to further leverage their monopoly.
| hrmtst93837 wrote:
| The scam only has to work on a tiny slice of users, and the
| people who fall for fake bank alerts or package texts will
| march through a pile of Android warnigns if the script is
| convincing enough. Once the operator gets them onto a PC, the
| whole thing gets easier because ADB turns it into a guided
| install instead of a phone-only sideload.
|
| That's why I don't think the extra prompts matter much beyond
| raising attacker cost a bit. Google is patching the visible
| path while the scam just moves one hop sideways.
| focusedone wrote:
| I'm generally OK with this, but the 24 hour hang time does seem a
| bit onerous.
|
| Most of the apps on my phone are installed from F-Droid. I guess
| the next time I get a new phone I'll have to wait at least 24
| hours for it to become useful.
|
| I'm seriously considering Graphene for a next personal device and
| whatever the cheapest iOS device is for work.
| janice1999 wrote:
| The apps might not be available though. Many developers are
| simply stopping in the face of Google's invasive policies. I
| don't blame them. Say goodbye to useful apps like Newpipe.
| limagnolia wrote:
| I don't see anything on NewPipe's website about not
| continuing development?
| TurboSkyline wrote:
| A few apps have been showing pop-ups warning users in
| advance that they are not going to do the verification.
| Obtanium is definitely on of them. I think I saw something
| similar on NewPipe.
| plorg wrote:
| If you install it or update it you will get a banner to
| this effect at first use.
| limagnolia wrote:
| Yes, but that isn't them giving up developing the app,
| that is them fighting back!
| tencentshill wrote:
| Newpipe impedes revenue for an already _free_ video hosting
| service. Google has less than zero obligation to them.
| zarzavat wrote:
| I remember when Microsoft got in trouble for bundling a web
| browser with the OS.
| limagnolia wrote:
| If my employer wants me to use a phone for work, they can buy
| whatever phone they want for me. I'm not going to buy a
| separate one just for them.
| RIMR wrote:
| This is hopefully an exciting time to consider a Motorola
| device, since they are partnering with GrapheneOS, but I worry
| that Google will block Google Play Services on any device that
| doesn't comply, so this might actually be a demoralizing time
| to be a GrapheneOS fan, when we watch them worm their stupid
| walled garden nonsense into the Motorola version of it.
| nijave wrote:
| Blocking Play might not be that bad if some
| frameworks/efforts crop up to allow easily targeting devices
| without it.
| drnick1 wrote:
| You don't need Google Play at all on GrapheneOS. You have to
| option of installing a sandboxed version of Google Play, but
| it isn't installed by default. Google's verification
| shenanigans are otherwise irrelevant to Graphene, it only
| applies to apps distributed through the Google store.
| janice1999 wrote:
| The forced ID for developers outside the Play store is already
| killing open source projects you could get on F-Droid. The EU
| really needs to identify this platform gatekeeping as a threat.
| As an EU citizen I should not be forced to give government ID to
| a US company, which can blacklist me without recourse, in order
| to share apps with other EU citizens on devices we own.
| hactually wrote:
| you know this is an EU requirement?
| janice1999 wrote:
| The DSA covers App stores with a large numbers of users -
| this is about allowing users side load unsigned apps. Afaik
| there is no requirement to identify the developers of
| applications that can be installed on a vendors platform
| (outside the app store). Otherwise Microsoft would require
| Government ID to compile and email someone an EXE.
| 2OEH8eoCRo0 wrote:
| Seems like a very reasonable compromise. What's the catch?
| hermanzegerman wrote:
| That I have to wait 24 Hours on my own device to install
| software?
| fsh wrote:
| I don't find it reasonable that Google wants to make me wait
| 24h to install software on a device I own.
| ygjb wrote:
| Meh. I get the annoyance, but it's a one time cost for a
| small subset of their users. I would prefer if there was a
| flow during device setup that allowed you to opt into
| developer mode (with all the attendant big scary warnings),
| but it's a pretty reasonable balance for the vast majority of
| their users. (I suspect the number of scammers that are able
| to get a victim to buy a whole new device and onboard it is
| probably very low).
| izacus wrote:
| Note that adb won't have the 24 hour cooldown if you're in
| such a hurry.
| jcul wrote:
| Good point, having a once off advanced option to completely
| bypass this at device setup would be good.
|
| Also, other commenters have mentioned that adb is
| unaffected by this which makes it seem like less of a
| problem, to me at least. Still inconvenient that even if
| you adb install fdroid you can't install apps directly from
| it.
| barnacs wrote:
| Get with the newspeak, it's called "sideloading" now and your
| corporate overlords get to dictate the terms.
| volkercraig wrote:
| They'll just remove the "Advanced" ability in a few years once
| they've frog boiled people into jumping through hoops to use
| their phone the way they want.
| janice1999 wrote:
| Developers, including non-US citizens, are forced to give
| Google their government ID to distribute apps. This enables
| Google to track and censor projects, like NewPipe, an
| alternative open source Youtube frontend, by revoking signing
| permissions for developers.
| 2OEH8eoCRo0 wrote:
| I don't see that on the page
| janice1999 wrote:
| They already announced it. Here they only mention the
| special case where it does not apply:
|
| > In addition to the advanced flow we're building free,
| limited distribution accounts for students and hobbyists.
| This allows you to share apps with a small group (up to 20
| devices) without needing to provide a government-issued ID
| or pay a registration fee.
|
| i.e. Government-issued ID and fees are needed for more than
| 20 devices, e,g, every app on F-Droid
| ai-inquisitor wrote:
| Enforcement of the device restriction would also mean
| they also are collecting information from your device
| about the app.
| Evidlo wrote:
| Isn't this a huge loophole? Couldn't a scammer just make
| many variants of their malware?
| codethief wrote:
| https://developer.android.com/developer-verification
|
| Note that the OP is about side loading, i.e. installing
| apps from non-Play Store sources and thereby circumventing
| developer verification.
| codethief wrote:
| This. Side loading being restricted is only one part of the
| problem; the other is mandatory developer verification for
| apps distributed through the Play Store.
| MishaalRahman wrote:
| >Developers, including non-US citizens, are forced to give
| Google their government ID to distribute apps.
|
| Developers can choose to not undergo verification, thereby
| remaining anonymous. The only change is that their
| applications will need to be installed via ADB and/or this
| new advanced flow on certified Android devices.
|
| Either way, you can still distribute your apps wherever you
| want. If you verify your identity, then there are no changes
| to the existing installation flow from a user perspective. If
| you choose not to verify your identity, then the installation
| will still be possible but only through high-friction methods
| (ADB, advanced flow). These methods are high-friction so
| anonymous scammers can't easily coerce their victims into
| installing malicious software.
| Evidlo wrote:
| My friend's little kid likes to make games that he and his
| friends can play. As far as I am aware, these apps don't
| require any permissions.
|
| Are apps like this more dangerous than browsing to a
| website? I thought they were entirely sandboxed from the
| rest of the device?
| occz wrote:
| That's not correct - the flow described in the post outlines
| the requirements to install any apps that haven't had their
| signature registered with Google.
|
| That means those apps still keep on existing, they are just
| more of a hassle to install.
| izacus wrote:
| This is downright wrong.
| 9cb14c1ec0 wrote:
| It's getting harder and harder to be an Android enthusiast.
| Especially given the hypocrisy of Google Play containing an awful
| lot of malware.
| mosura wrote:
| From a detached perspective Play Services itself is practically
| sanctioned malware and this is to protect that monopoly.
| omnifischer wrote:
| Those working in Google (AOSP) that write these code should be
| ashamed of themselves. Eventually they are doing a bad thing for
| the society.
| astra1701 wrote:
| This is going to hurt legitimate sideloading _way_ more than
| actually necessary to reduce scams:
|
| - Must enable developer mode -- some apps (e.g., banking apps)
| will refuse to operate and such when developer mode is on, and so
| if you depend on such apps, I guess you just can't sideload?
|
| - One-day (day!!!) waiting period to activate (one-time) -- the
| vast majority of people who need to sideload something will
| probably not be willing to wait a day, and will thus just not
| sideload unless they really have no choice for what they need.
| This kills the pathway for new users to sideload apps that have
| similar functionality to those on the Play Store.
|
| The rest -- restarting, confirming you aren't being coached, and
| per-install warnings -- would be just as effective _alone_ to
| "protect users," but with those prior two points, it's clear that
| this is just simply intended to make sideloading so inconvenient
| that many won't bother or can't (dev mode req.).
| pmontra wrote:
| You have to wait one day only once, when enabling the feature.
| I agree that enabling developer mode could be a problem but
| mostly because it's buried below screens and multiple touches.
| As a data point, I enabled developer mode on all my devices
| since 2011 and no banking app complained about it. But it could
| depend by the different banking systems of our countries.
| frays wrote:
| You don't use the HSBC or Citibank app then I assume?
| pmontra wrote:
| They don't operate in my county AFAIK. However that
| reinforces my idea that the endgame will be a pristine
| Android phone in a drawer at home with the banking apps
| required for accessing their sites with 2FA and another
| phone in my pocket for daily use.
| curt15 wrote:
| The one-day waiting period is so arbitrary. Have they
| demonstrated any supporting data? We know google loves to
| flaunt data.
|
| Something like Github's approach of forcing users to type the
| name of the repo they wish to delete would seem to be more than
| sufficient to protect technically disinclined users while still
| allowing technically aware users to do what they please with
| their own device.
| xnx wrote:
| > The one-day waiting period is so arbitrary.
|
| Scammers aren't going to wait on the phone for a day with
| your elderly parent.
| cogman10 wrote:
| Sure, but what about a 30 minute delay? 1 hour? 2 hour?
|
| 24 is just so long.
|
| But also, my expectation is that a scammer is going to just
| automate the flow here anyways. Cool, you hit the "24 hour"
| wait period, I'll call you back tomorrow, the next day, or
| the next day and continue the scam process.
|
| It might stop some less sophisticated spammers for a little
| bit, but I expect that it'll just be a few tweaks to make
| it work again.
| fwip wrote:
| 24 hours is long enough to get them off the phone, and
| potentially talking to other people who might recognize
| the scam.
|
| There will be some proportion of people who mention to
| their spouse/child/friend about how Google called them to
| fix their phone, and are saved by that waiting period.
| MishaalRahman wrote:
| Exactly - the idea is to make it harder for scammers to
| create a false sense of urgency.
| tauntz wrote:
| Sure, but wouldn't 35 hours do the same trick? Or 5
| hours? Or 10 hours and 28 minutes? :)
|
| The question is, why exactly 24 hours? The argument is
| that the time limit is set to protect the users and
| sacrifice usability to do so. So it would be prudent to
| set the time limit to the shortest amount that will
| protect the user -> and that shortest amount is
| apparently 24 hours, which is rather.. suspiciously long
| and round :)
| Groxx wrote:
| You've got to pick some time value (if you choose this
| route at all), and if the goal is to prevent urgency-
| coercion it needs to be at least multiple hours. An
| extremely-common-for-humans one seems rather obvious
| compared to, like, 18.2 hours (65,536 seconds).
|
| Unless you want to pick 1 week. But that's a lot more
| annoying.
| jcul wrote:
| Well, I guess 24 hours gives a good change to include at
| least one window where a vulnerable person might be able
| to speak with a trusted contact.
|
| Someone who lives in another timezone or works weird
| hours etc. Our routines generally repeat on 24hour
| schedules, so likely to be one point of overlap.
| nvme0n1p1 wrote:
| Have you ever watched Kitboga? Scammers call people back
| all the time. They keep spreadsheets of their marks like a
| CRM. It takes time to build trust and victimize someone,
| and these scammers are very patient.
| ronsor wrote:
| Scammers will gladly wait on hold for 10 hours a day, for
| a week, if they think they'll get their Bitcoin.
|
| They have infinite time and patience.
| izacus wrote:
| It sounds like the 24 hour advanced flow should be
| completely removed then to protect these people. Right?
| It can't be perfect so to follow you, it should not
| exist.
| hbn wrote:
| Scammers already will spend multiple days on a scam call.
| Watch some Kitboga videos, he'll strings them along for a
| week.
|
| "Google will call you again tomorrow to get you your
| refund."
|
| There, we've successfully circumvented all of Google's
| security engineering on this "feature."
| fhdkweig wrote:
| Check out this A&E Intervention episode for Greg. They
| have continuously worked this guy over for months.
|
| https://youtu.be/YIR-nJv_-VA?t=121
|
| They don't mind being patient when they have dozens of
| other victims in the wait queue.
| yunnpp wrote:
| This is obvious to anyone with a brain. I'm not familiar
| with scam logistics or the videos you mentioned, and the
| exact same line you put in quotes is what first came to
| my mind.
|
| tl;dr of this post is that Google wants to lock down
| Android and be its gatekeeper. Every other point of
| discussion is just a distraction.
| free_bip wrote:
| Brother, there's an entire genre of scamming where the
| scammers spend _months_ building rapport with their
| victims, usually without ever asking for anything, before
| "cashing out". One day is nothing.
| curt15 wrote:
| Wouldn't a wait time like 2 hours with some jitter make
| it more difficult for a scammer to pursue the case?
| People aren't going to be willing to stay on the phone
| for hours at a time. With 24 hour wait, the scammer could
| just schedule another call for the next day.
| MishaalRahman wrote:
| Right, this friction makes it much harder for a scammer to
| get away with saying something like, "wire me $10,000 right
| now or you won't see your child ever again!" as the
| potential victim is forced to wait 24 hours before they can
| install the scammer's malicious app, thus giving them time
| to think about it and/or call their trusted contacts.
| joecool1029 wrote:
| The sheer arrogance that you think someone manipulated
| successfully will just re-think the situation and ask
| their friends/family. The naivety to assume all scammers
| are impulsive fools and don't do this for a living, as
| their primary line of work.
|
| So Google's going to add some nonsense abstraction layer
| and when this fails to curb the problem after a 24 hour
| wait, it will be extended more maybe a week, and more
| information must be collected to release it. We all know
| how this goes.
| izacus wrote:
| The sheet arrogance of you thinking that you know more
| about these problems than people actually combating them
| at scale.
| prmoustache wrote:
| Potencial victim's AI agents will wait patiently those 24
| hours. In fact it may just wait exactly 24 hours and not
| one more second.
| trillic wrote:
| To paste code into the chrome dev console you just need to
| type "allow pasting"
| xnx wrote:
| > some apps (e.g., banking apps) will refuse to operate and
| such when developer mode is on
|
| JFC. Why would an app be allowed to know this? Just another
| datapoint for fingerprinting.
| tadfisher wrote:
| Yes, it is really dumb that some of these settings are
| exposed to all apps with no permission gating [0]. But it
| will likely always be possible to fingerprint based on
| enabled developer options because there are preferences which
| can only be enabled via the developer options UI and
| (arguably) need to be visible to apps.
|
| 0: https://developer.android.com/reference/android/provider/S
| et...
| zzo38computer wrote:
| What might help better is having permissions that you can
| set separate settings that can be read for different apps
| (including the possibility to return errors instead of the
| actual values), even if they can be read by default you can
| also change them per apps. (This has other benefits as
| well, including possibility of some settings not working
| properly due to a bug, you can then work around it.)
| ninininino wrote:
| Because estimates suggest Americans lose about $119 billion
| annually to financial scams, which is a not insignificant
| fraction of our entire military budget, or more than 5% of
| annual social security expenditures.
| wolvoleo wrote:
| Maybe they should educate them then. Oh wait education is
| communist. And bad for the religious conservatives.
| int0x29 wrote:
| Most of the victims were last in school in the 1960s when
| all this stuff didn't exist. Also from experience
| teaching people with dementia or memory issues is kinda
| challenging as they just forget.
| acrophiliac wrote:
| I wonder if you might be relying on a stereotype of
| victims. Here's some recent data: "The 2024 FTC Consumer
| Sentinel Network reported that 44% of all 20-somethings
| claimed losses in 2023". More data here:
| https://www.synovus.com/personal/resource-center/fraud-
| preve...
| greenchair wrote:
| That's what I would expect too - old and young.
| nijave wrote:
| So put a disclaimer in... Same way tons of other stuff
| works...
| warkdarrior wrote:
| Nobody reads disclaimers, and people who get scammed and
| lose their life savings won't be made whole by being told
| "you accepted the disclaimer, nothing we can do."
| prmoustache wrote:
| That is unrelated to apps installed outside of the
| playstore (which by the way is full of malware).
|
| It is like mandating that people use rainjackets in the
| rain to avoid getting cancer.
| tadfisher wrote:
| Banks do these things to check security boxes, not to
| prevent scams.
|
| In this case, they don't want users to reverse-engineer
| their app or look at logs that might inadvertently leak
| information about how to reverse-engineer their app. It is
| pointless, I know, but some security consultant has created
| a checkbox which _must be checked at all costs_.
| nijave wrote:
| It's always boggled my mind what native apps are allowed to
| know versus the same thing running in a browser on the same
| device.
| inyorgroove wrote:
| As described developer mode is only required at install time.
| Remains to be seen in the actual implementation, but as
| described in the post developer mode can be switched off after
| apps have been side loaded.
| tadfisher wrote:
| We'll see when this rolls out, but I don't foresee the package
| manager checking for developer mode when _launching_
| "unverified" apps, just when _installing_ them. AFAICT the
| verification service is only queried on install currently.
| MishaalRahman wrote:
| Googler here (community engagement for Android) - I looked
| into the developer options question, and it's my
| understanding that you don't have to keep developer options
| enabled after you enable the advanced flow. Once you make the
| change on your device, it's enabled.
|
| If you turn off developer options, then to turn off the
| advanced flow, you would first have to turn developer options
| back on.
| rtkwe wrote:
| > - Must enable developer mode -- some apps (e.g., banking
| apps) will refuse to operate and such when developer mode is
| on, and so if you depend on such apps, I guess you just can't
| sideload?
|
| What apps are those? I've yet to run into any of my banking
| apps that refuse to run with developer mode enabled. I've seen
| a few that do that for rooted phones but that's a different
| story. I've been running android for a decade and a half now
| with developer mode turned on basically the whole time and
| never had an app refuse to load because of it.
| jcelerier wrote:
| RBC in Canada for instance, just having developer mode
| enabled blocks it here
| wolvoleo wrote:
| Wero in Europe. It's really insane. They make wero to make us
| less dependent on US tech and then hamstring it in this way.
| looperhacks wrote:
| I can use Wero just fine in my banking app. Can't try the
| app that's called Wero in the Play store because it just
| directs me to my banking app. But I can open it at least
| ...
| adzm wrote:
| I enable developer mode on every android phone to at least
| change the animation durations to twice the speed. I also
| have never run into an issue fwiw
| andrewaylett wrote:
| SumUp won't let you use your phone to accept contactless
| payments while developer mode is enabled. You can still use
| an external card reader though.
| flykespice wrote:
| Brazil government app refuses to operate with developer mode
| on
| MishaalRahman wrote:
| >- Must enable developer mode -- some apps (e.g., banking apps)
| will refuse to operate and such when developer mode is on, and
| so if you depend on such apps, I guess you just can't sideload?
|
| Hi, I'm the community engagement manager @ Android. It's my
| understanding that you don't have to keep developer options
| enabled after you enable the advanced flow. Once you make the
| change on your device, it's enabled.
|
| If you turn off developer options, then to turn off the
| advanced flow, you would first have to turn developer options
| back on.
|
| >- One-day (day!!!) waiting period to activate (one-time) --
| the vast majority of people who need to sideload something will
| probably not be willing to wait a day, and will thus just not
| sideload unless they really have no choice for what they need.
|
| ADB installs are not impacted by the waiting period, so that is
| an option if you need to install certain unregistered
| applications immediately.
| kotaKat wrote:
| So... we're just going to move the scam into convincing the
| end user to run an application on their PC to ADB sideload
| the Scam App. Got it, simple enough. It's not hard to coach a
| user into clicking the "no, I'm not being coached" button,
| too, to guide them towards the ADB enable flow.
| ufmace wrote:
| I think this is a "don't let the perfect be the enemy of
| the good thing". It's technically possible to get around,
| but adding more speed bumps in the way of scammers tends to
| drastically reduce the number of people who get scammed.
| hbn wrote:
| > ADB installs are not impacted by the waiting period, so
| that is an option if you need to install certain unregistered
| applications immediately.
|
| Someone is just going to make a nice GUI application for
| sideloading apks with a single drag-and-drop, so if your idea
| is that ADB is a way to ensure only "users who know what
| they're doing" are gonna sideload, you've done nothing. This
| is all security theatre.
| tbodt wrote:
| > "For a lot of people in the world, their phone is their
| only computer, and it stores some of their most private
| information," Samat said.
|
| Not applying the policy to adb installs makes a lot more
| sense if the people this is trying to protect don't have a
| computer
| eclipxe wrote:
| You can run adb install locally without a computer
| grishka wrote:
| If you mean things like Shizuku or local adb connection
| through Termux, it's quite an awkward process to set up
| even for someone like me who's been building Android apps
| since 2011. Like, you _can_ do if you really really need
| it, but most people won 't bother. You have to do it
| again after every reboot, too.
| g947o wrote:
| Scammers will figure something out to help that workflow
| smoother, you can count on that.
| orthoxerox wrote:
| People who want your money always want to have really
| great UX. I remember how painless buying lottery tickets
| online was, it was the smoothest checkout experience in
| all of online shopping I have ever done.
| RulerOf wrote:
| I've seen a few apps that run locally on Android and hook
| into the ADB connection over loopback networking to do
| certain things.
|
| This just adds the step of "download Cool ABD Installer
| from the play store" to the set of directions I would
| think.
| Retr0id wrote:
| The scammers don't even need to make a GUI, they just need
| to get you to enable adb-over-tcp and bridge that to their
| network somehow - an ssh client app would do the trick.
| ForHackernews wrote:
| How many people do you suspect are gullible enough to
| fall for these scammers but also competent enough to
| install an SSH client and enable port-forwarding for an
| ADB proxy? Like fifteen people worldwide?
| Retr0id wrote:
| More than the number of people who will wait 24h
| plst wrote:
| How many people are gullible enough right now to plug a
| phone to a laptop over USB and execute an exe on an
| operating system with no sandboxing at all? ADB even
| seems to work over webusb. (at that point you may as well
| give up on hacking the phone, but I digress). That's
| exactly why I believe the problem is more complicated and
| why Google's solution is not really fixing anything, not
| for the users.
| Gander5739 wrote:
| scrcpy can already do that.
| wolvoleo wrote:
| Do I need to be signed in to Google play to get the
| sideloading exception turned on? I don't sign in to it
| because I don't want to have my phone associated with a
| Google account. But I can't uninstall play completely on the
| devices I have.
|
| It says something about 'restart your phone and
| reauthenticate' that's why I'm asking. What do you
| autenticate?
|
| > ADB installs are not impacted by the waiting period, so
| that is an option if you need to install certain unregistered
| applications immediately.
|
| Um yeah but then do I have to install every update via adb? I
| want to just use F-Droid.
| catgirlinspace wrote:
| I think the authentication is doing your
| face/fingerprint/passcode unlock?
| MishaalRahman wrote:
| Correct.
| MishaalRahman wrote:
| >It says something about 'restart your phone and
| reauthenticate' that's why I'm asking. What do you
| autenticate?
|
| You're authenticating that you're the device owner (via
| your device's saved biometrics or PIN/pattern/password).
|
| >Um yeah but then do I have to install every update via
| adb? I want to just use F-Droid.
|
| No, once you go through the advanced flow and choose the
| option to allow installing unregistered apps indefinitely,
| you can both install and update unregistered apps without
| going through the flow again (or using ADB).
| wolvoleo wrote:
| Ah thanks I'm glad I don't need a Google account to
| enable this.
| largbae wrote:
| May I use ADB or Developer mode to disable the one-day
| period?
| nightpool wrote:
| Yes, ADB disables the 1-day period.
| headsman771 wrote:
| Why do you keep harping on about ADB installs. That's not
| helpful. It doesn't help me install open source apps from
| FDroid. It's ridiculous that you think booting up a computer
| and using ADB is a reasonable workaround. It isn't.
| NoahZuniga wrote:
| You would be able to install f droid and it's apps without
| going through this flow.
| JeremyNT wrote:
| So give me a way to completely disable this nonsense via ADB.
|
| This is hot garbage. Eliminating third party app stores like
| F-Droid defeats the whole purpose many of us even bother
| running Android instead of locked down Apple stuff.
| worble wrote:
| > It's my understanding that you don't have to keep developer
| options enabled after you enable the advanced flow. Once you
| make the change on your device, it's enabled.
|
| Ok, but why is this advertised to applications in the first
| place? It's quite literally none of their business that
| developer options are enabled and it's a constant source of
| pain when some government / banking apps think they're being
| more "secure" by disallowing this.
| jayofdoom wrote:
| The only reason I run android over iOS is the freedom to
| install things I want on it. A waiting period is unacceptable
| as Android has proven that it can't be trusted not to tighten
| the grip further.
|
| Reconsider.
| Dwedit wrote:
| Medical apps (such as those that talk to insulin pumps) also
| refuse to run when developer mode is turned on.
| andyjohnson0 wrote:
| > some apps (e.g., banking apps) will refuse to operate and
| such when developer mode is on
|
| Enable dev mode, sideload the apk, then disable dev mode. I'd
| argue that it is poor security practice to keep developer mode
| enabled long-term on a phone that is used for everyday
| activities, such as banking.
| lvales wrote:
| > This is going to hurt legitimate sideloading way more than
| actually necessary to reduce scams
|
| Isn't that the objective? "Reducing scams" is the same kind of
| argument as "what about the children"; it's supposed to make
| you stop thinking about what it means, because the intentions
| are so good.
| girvo wrote:
| That is working as intended. Google wants to kill side loading.
| prmoustache wrote:
| Google wants to kill installing apps outside of playstore.
|
| Installing apps manually or through another store app is not
| "sideloading".
|
| Sideloading is the new jaywalking, a newish word to pretend
| that a pretty normal action would be in any way illegal,
| dangerous or harmful.
| prism56 wrote:
| >the vast majority of people who need to sideload something
| will probably not be willing to wait a day
|
| I disagree with this. Won't somebody who need to sideload
| something will just try again the next day...
| jcul wrote:
| I don't know. I've been silently outraged and disappointed by
| this whole forbidding of unverified apps, but also hopeful it
| wouldn't affect me much as a user of grapheneos.
|
| But this process seems pretty reasonable to me.
|
| I'd like to think it is due in part to the efforts of F-Droid
| and others.
|
| Waiting a day, once, to disable this protection doesn't seem
| like a big deal to me. I'd probably do it once when I got a
| phone and then forget about it.
|
| I happen to have developer mode enabled right now, for no good
| reason other than I never disabled last time I needed it.
| Haven't had any issues with any apps.
|
| I actually think these protections could help mitigate
| scammers.
| nacozarina wrote:
| their goal is to make software installation as painful as
| possible without being outright impossible : 'sideloading' is
| only ever a euphemism for 'illegitimate'.
| teroshan wrote:
| That's a lot of words to explain how to install things on the
| device I supposedly own.
|
| Wondering how long the blogpost would be if it explained what the
| flow for corpoloading applications approved by Google's
| shareholders would be?
| cobbal wrote:
| Can you set your clock forward or does this also require phoning
| home to a central server to install an app on your computer?
| hypeatei wrote:
| I'll say it again: this isn't a problem for Android to solve.
| Scammers will naturally adapt their "processes" to account for
| this 24-hour requirement and IMO it might make it seem more
| legitimate to the victim because there's less urgency.
|
| The onus of protecting people's wealth should fall on the bank /
| institution who manages that persons wealth.
|
| Nevertheless, this solution is better than ID verification for
| devs.
| limagnolia wrote:
| Why should the bank/institution be responsible for protecting
| individuals from themselves? They don't have police power-
| protecting people from bad actors is like, _the_ reason to have
| a state. If the state wishes to farm it out to third parties,
| then we don 't need the state anymore!
| hypeatei wrote:
| The bank/institution is where the money is leaving from
| therefore they should implement policies that protect
| vulnerable customers like seniors, for example. I don't know
| how that looks but it seems reasonable that they could put
| limits on an account flagged "vulnerable person"
|
| I'm not sure what you're getting at with the rant about
| police power and a state? Google isn't the government either.
| What would legislation provide that banks can't already do
| today?
| limagnolia wrote:
| Sure, there are things banks can do, and those are features
| they can market. But ultimately, if the state isn't
| pursuing criminals who prey on the vulnerable, then society
| as we know it has failed and we would need a new society,
| or a new state, or both...The bank can't arrest anyone!
|
| I never said anything about it being Googles
| responsability, I agree it is not. And the only legislation
| that might be necessary over what we have is a budget
| directly to go after criminal fraudsters.
| hypeatei wrote:
| Fraud is already illegal, the issue is that these
| scammers reside in other countries. I don't doubt there
| could be pressure applied from really high up at the
| diplomatic level but I highly doubt the FBI for example
| is going to be able to do anything even with legislation.
| richwater wrote:
| Yea I have no idea why the original commenter thinks Banks
| should have the power to tell me what I can and can't do with
| my own money.
|
| It's nice that Zelle has checks and identity information
| shown to you when you're sending money, but if I click
| through 5 screens that say "Yes I know this person" but I
| actually don't.....no amount of regulation is going to solve
| that.
| hypeatei wrote:
| Banks absolutely have that power and will stop transactions
| that seem suspicious or fraudulent already, no? Sometimes
| they'll call/text to verify you want it go through. I
| imagine that type of thing but cranked up for accounts
| flagged "vulnerable" where a family or the person
| themselves can check a box saying "yes, lockdown this
| account heavily please" (or whatever you can imagine, idk,
| I'm not a bank)
| EvanAnderson wrote:
| > I'll say it again: this isn't a problem for Android to solve.
|
| They're not solving that problem. They're using it as an excuse
| to lock down the platform further and assume more control. Any
| incidental benefit for user "security" is an unintended
| consequence of their real agenda.
| silver_sun wrote:
| It's a little inconvenient for someone setting up a new phone to
| have to wait a full day to install unregistered apps. But while I
| can't speak for others, it's a price I'm personally willing to
| pay to make the types of scams they mention much less effective.
| The perfect is the enemy of the good.
| nullc wrote:
| On what basis do you believe that it will meaningfully reduce
| the dollars lost or persons harmed by fraud, as opposed to
| simple shuffling around the exact means used?
| Evidlo wrote:
| How would you feel about needing to wait 24 hours to visit an
| "unapproved" website on your phone? You would pay Google/Apple
| $25 to get whitelisted so people can browse to your personal
| website without getting a scary security message.
|
| This is the same thing since it applies to _all_ apps, not just
| apps that need special permissions.
| branon wrote:
| This 24-hour wait time nonsense is a humiliation ritual designed
| to invalidate any expectation of Android being an open platform.
| The messaging is very clear and the writing's on the wall now,
| there's nowhere to go from here but down.
| module1973 wrote:
| Am I going to have to wait 24hrs to have Google's malware and
| spyware forceloaded onto my phone, or is this a different
| category of malware?
| sebtron wrote:
| That comes preinstalled :)
| xnx wrote:
| This is eminently reasonable.
|
| Now if only Android would allow for stronger sandboxing of apps
| (i.e. lie to them about any and all system settings).
| fluidcruft wrote:
| I think it's only reasonable if you can install updates without
| having to do the whole dance (assuming you do the 7-day rather
| than permanent unlock).
| occz wrote:
| The 24 hour wait period is the largest of the annoyances in this
| list, but given that adb installs still work, I think this is a
| list of things I can ultimately live with.
| summermusic wrote:
| 24 hour mandatory wait time to side load!? All apps I want to use
| on my phone are not in the Play Store. So I buy a new phone (or
| wipe a used phone) and then I can't even use it for 24 hours?
| 0x457 wrote:
| You can if you have a way to use ADB.
| MishaalRahman wrote:
| 1) The one-time, one-day waiting period only applies if you go
| through the advanced flow to allow installing unregistered
| apps. You can still install registered apps (ie. apps made by
| developers who have verified their identity) even if they're
| distributed outside the Play Store.
|
| 2) You can use ADB to immediately install unregistered apps.
| ADB installs are not subject to the waiting period.
| NooneAtAll3 wrote:
| asian development bank?
| bithaze wrote:
| Android Debug Bridge, a CLI for connecting to Android
| devices: https://developer.android.com/tools/adb
| nxtbl wrote:
| 3) And how can we keep on using F-Droid and other app stores?
|
| 4) How can we install apps made by devs who won't do the
| verification dance with Google?
| MishaalRahman wrote:
| Developers who distribute Android apps on other app stores
| are not strictly required to undergo verification and thus
| can remain anonymous, but if they choose not to, then later
| this year (when the enforcement of verification goes
| active) their apps can only be installed on certified
| Android devices via ADB and/or the new advanced flow.
|
| Thus, you can still install unregistered apps if they're
| distributed via F-Droid or other sources, but to do so, you
| will need to use ADB and/or go through the new advanced
| flow. And remember, the new advanced flow is a one-time
| process - once you go through with it, you can allow your
| device to install unregistered apps indefinitely!
| user34283 wrote:
| I only hope this brilliant proposal is met with a new
| advanced fine from regulators.
| gumby271 wrote:
| So let's say I'm F-Droid, an organization making a direct
| competitor to the Google Play Store and openly pointing out
| how much scammy shit is available in that store. My options
| are 1) submit my identity to Google (my competitor) so they
| can identify me and choose to revoke that verification at any
| point, or 2) I can tell all my users that they must go
| through these scary dialogs AND wait 1 day before they can
| use my competing product? That's cool, glad we've got the
| options laid out in front of us.
|
| I forgot 3) instruct my users how to use ADB from another
| computer to install my competing app. Awesome.
| user34283 wrote:
| It's really ridiculous.
|
| You'd think regulators should make Google ship a 'Choose my
| store(s)' screen at setup, but Google thinks the opposite
| is the case and Google should also be able to control app
| distribution outside of the Playstore.
| benatkin wrote:
| From purely a usability standpoint, not a freedom standpoint, I
| would actually be okay with that for my personal use if it
| stayed like that. But the point is that they're just making it
| worse and worse. They won't stop with this. I can arrange to do
| without an important app for a day, even if I had to get a new
| phone unexpectedly (If I had to skip attending an event and
| stay at home where my computer is, because I could only
| properly be on call with my sideloaded app, I'd chalk it up to
| an unusual situation). But it won't be long before they change
| it again.
| garciansmith wrote:
| Yeah, it's terrible. I buy a new phone and then can't
| effectively use it for 24 hours? Half my apps are downloaded
| from F-Droid, which I've used for over a decade. Just gives me
| another reason why I'm very happy to have recently moved over
| to GrapheneOS.
| aboringusername wrote:
| It's not like the Google Play store hasn't been known to host
| malicious apps, yet you are not required to wait 24 hours before
| you install apps from their store.
|
| I suspect they are hoping users just give up and go to the play
| store instead. Google touts about "Play Protect" which scans all
| apps on the device, even those from unknown sources so these
| measures can barely be justified.
|
| Imagine if Microsoft said you need to wait 24 hours before
| installing a program not from their store, which is against the
| entire premise of windows.
|
| Computing, I once believed was based on an open idea that people
| made software and you could install it freely, yes there are bad
| actors, but that's why we had antivirus and other protection
| methods, now we're inch by inch losing those freedoms. iOS wants
| you to enter your date of birth now.
|
| The future feels very uncertain, but we need to protect the
| little freedoms we have left, once they're gone, they're gone for
| good.
| dang wrote:
| Is there an accurate, neutral third party link about this that we
| can make the primary link instead?
|
| https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...?
|
| Edit: I've put one up there now - if there's a better article,
| let us know and we can change it again. I put the submitted URL
| in the toptext.
| wolvoleo wrote:
| Do you need a Google account to opt out of the restriction? It
| says something about authenticating.
|
| I don't have a Google account on my Androids. But I can't remove
| play services on them, sadly. As an intermediate protection I
| just don't sign in to Google play, that gives them at least a bit
| less identifying information to play with.
|
| I hope this can be done without a Google account.
| aboringusername wrote:
| The reauthenticate means using device pin/biometrics if you
| have them enabled.
|
| You will not need a Google account.
| wolvoleo wrote:
| Oof that's what I was hoping for, thanks!
| devsda wrote:
| Death, taxes and _escalating safety_ are the only certainities in
| this tech dominated world. So, be ready for more safety in the
| next round few months /years down the line. Eventually Android
| will become as _secure_ as ios. We need a third alternative
| before that day comes.
|
| It's not a win by any means. I hope that we don't stop making
| noise.
| wolvoleo wrote:
| It's not secure when one of the main adversaries (Google)
| controls all the keys.
| Mogzol wrote:
| I believe that is why "escalating safety" and "secure" were
| written in italics in the comment. Those are the terms Google
| would use, not necessarily the truth.
| wolvoleo wrote:
| Ahh in the glider app I use the italics didn't appear. I
| use very old version because I didn't like their last
| redesign.
| varispeed wrote:
| Google serves ads with known scams and nothing seems done about
| it.
|
| Yet, they are concerned about this.
|
| It has nothing to do with safety, but everything to do with
| control.
|
| I remember when Google disabled call recording in Android, so
| you no longer could record scammers. Thanks to recording I was
| able to get money back from insurance company that claimed they
| absolutely didn't sell me this and that over the phone (paid
| for premium insurance and got basic).
| flyinghamster wrote:
| > I remember when Google disabled call recording in Android,
| so you no longer could record scammers.
|
| Citation needed. My Pixel 7a with the latest updates has
| settings for call recording in the phone app. Since I never
| screwed around with it, I'd assume these are the defaults:
|
| Call recording is turned on, with "asks to record calls" set
|
| Automatically delete recordings is "never"
|
| Automatically record calls with non-contacts is off
|
| No specific numbers to automatically record calls are set
|
| There is also a note that you have to agree to their ToS to
| use it, and I'd also suggest being careful if you live in a
| jurisdiction that requires two-party consent for recording.
|
| In any case, I'm of the opinion that if F-Droid goes, I'm
| basically going to treat this as a feature phone and stay
| away from third-party apps in general aside from "musts" like
| banking.
| dzikimarian wrote:
| It was added recently to Google dialer app. If you want to
| use external one or aren't on pixel which received this
| update then bad luck for you.
| EvanAnderson wrote:
| > It's not a win by any means.
|
| It's a a defeat, albeit a minor one. The defeats will escalate
| until there's nothing left to lose. "Normies" don't care and
| the tech people who do care are fewer and further between than
| you'd think.
| odiroot wrote:
| *Tightening control. Nothing about safety here.
| lucasay wrote:
| The goal seems to be breaking the real-time guidance scammers
| rely on. 24h probably works, but it feels like a heavy tradeoff
| for legit users.
| EvanAnderson wrote:
| Capitulating now means next time the terms of the deal will be
| worse.
| hananova wrote:
| Scammers will just start the process and call back the next
| day. There is an entire genre of scam relying on slowly
| building rapport and only cashing in once all the way at the
| end.
| grishka wrote:
| At this point I'm convinced that there's something deeply wrong
| with how our society treats technology.
|
| Ruining Android for everyone to try to maybe help some rather
| technologically-hopeless groups of people is the wrong solution.
| It's unsustainable in the long run. Also, the last thing this
| world needs right now is even more centralization of power.
| _Especially_ around yet another US company.
|
| People who are unwilling to figure out the risks _just should not
| use smartphones and the internet_. They should not use internet
| banking. They should probably not have a bank account at all and
| just stick to cash. And the society should be able to accommodate
| such people -- which is not _that_ hard, really. Just roll back
| some of the so-called innovations that happened over the last 15
| years. Whether someone uses technology, and how much they do,
| should be a choice, not a burden.
| frogperson wrote:
| Its not society, this is simply more fascism. Corperate and
| government cooperation to surviel and controll the masses.
|
| So long as the 5g chips and the 2 mobile app stores remain
| under control, then 5 eyes has nearly full coverage.
| pixl97 wrote:
| A fascist society is a society. Members of that society will
| gladly vote in more fascism.
| guelo wrote:
| > just should not use smartphones and the internet
|
| That's ridiculous. Phones are being made more and more of a
| requirement to participate in society, including by
| governments.
| grishka wrote:
| Which is _exactly_ my point! This is exactly the thing that
| desperately needs to be undone.
| coldtea wrote:
| > _That 's ridiculous. Phones are being made more and more of
| a requirement to participate in society, including by
| governments._
|
| The latter is what's ridiculous, not what the parent
| suggests.
| gzread wrote:
| If the government wants to force me to use a certain device,
| it should give me that device.
| NullPrefix wrote:
| >They should probably not have a bank account at all and just
| stick to cash
|
| Pretty much illegal in some parts of EU
| cenamus wrote:
| Source?
|
| Also how is it related to the EU if it only affects certain
| places? Could have just said certain places in Europe
| pfortuny wrote:
| Spain: you must be paid through a bank if you
|
| -have a steady contract -are paid more than 1000EUR for a
| job (say you are self-employed).
| foepys wrote:
| Not illegal per se in Germany but you won't find a legal
| job that doesn't require you to have a bank account.
| Benefits will also only be paid electronically (exceptions
| for some asylum seekers apply).
|
| You also cannot get a tax refund or pay taxes without a
| bank account.
| derfniw wrote:
| Illegal would by a hyperbole. But the noose is tightening a
| bit.
|
| There are upcoming limits for cash transactions (10K,
| countries can opt to go lower), and strong requirements for
| identity verification at 3K or more euros in cash.
|
| See: https://www.deloittelegal.de/dl/en/services/legal/pers
| pectiv...
|
| EDIT: The other side of the coin is that banks are
| _required_ to give legal residents of a country a basic
| account that can be used for payments.
| hjadal wrote:
| Also illegal in Denmark. You need a NemKonto by law. Also
| making cash payments over 15000 is illegal since 2024. So
| you can't make a large purchase without a bank transfer.
| pfortuny wrote:
| Completely illegal in Spain if you have a paid job.
| grishka wrote:
| Not sure how it works in countries that didn't go through 80
| years of socialism, but I assume that you're saying that in
| those countries, your salary is required to go to your bank
| account and can't be paid in cash. Then you can still pretty
| much "stick to cash" by withdrawing the whole thing on your
| payday. But then idk, maybe everyone in those countries is
| aware of the risks related to keeping their money in a bank,
| it's just the _internet banking_ that introduces the new ones
| for them.
| pfortuny wrote:
| All withdrawals of more than 1000EUR in Spain must be
| accounted for and more than 5000EUR must be authorized.
|
| You "may" but maybe you "cannot".
| coldtea wrote:
| > _Then you can still pretty much "stick to cash" by
| withdrawing the whole thing on your payday._
|
| Not if you want to make a purchase beyond a small amount,
| like $500 or $1000. Then it has to be through some fucking
| bank or CC.
| estimator7292 wrote:
| Your mistake is taking Google's argument at face value.
| Protecting users is an outright lie, this is _purely_ about
| control.
|
| Google doesn't give one single shit if users download malware
| from the Play Store, but hypothetical malware from third party
| sources is so much worse that we need to ruin the whole OS?
| That doesn't pass the sniff test.
|
| Google wants to make sure you can only download malware from
| developers who give google a cut. They want to control the OS
| and remove user choice. That's all it is. That's what it's
| always been about.
|
| "Protecting users" is a pretense and nothing more. Google does
| not care _at all_ about user safety. They aren 't even capable
| of caring at this point. There are far, _far_ cheaper and more
| effective ways to actually protect users, and google isn 't
| doing any of them.
| grishka wrote:
| I'm assuming good faith and giving them the benefit of the
| doubt.
|
| Of course it _might_ be that they want more control. In
| addition to controlling the world 's most popular web browser
| and the world's most popular search engine and the world's
| most popular online advertising network and the world's most
| popular online video service.
| nijave wrote:
| It's really hard to when there's already technical
| solutions. They could require a process like bootloader
| unlocking that puts it in "dev" mode for instance
|
| While signing is useful, leaving no escape hatch imo is
| blatantly predatory
| grishka wrote:
| These restrictions already don't apply to something you
| install over adb, so there's already that. But that still
| considerably raises the bar for things like _apps made by
| sanctioned entities_ , for example, most Russian banks.
| Teckla wrote:
| It's all part of the war on general computing. This dystopian
| nightmare is coming to desktop operating systems too. See the
| age verification stuff that's all of a sudden being pushed
| hard by countries all over the world.
|
| As someone that was going to switch from iPhone to
| Android/Pixel later this year, at least now I know not to
| bother anymore, as the locking down of Android won't stop
| here.
| itsdesmond wrote:
| what
| zadikian wrote:
| Is this even the reason? If Android phonemakers are simply
| concerned about tech-illiterate users switching to iPhone, they
| could sell a locked-down Android phone that requires some know-
| how to unlock.
| giancarlostoro wrote:
| This was a reason that someone at Google gave iirc, but its
| ridiculous.
| giancarlostoro wrote:
| Idiocracy needs a spiritual "sequel" with modern times.
| benlivengood wrote:
| It is called baseline reality, unfortunately.
|
| We haven't started watering crops with salt-water but it's
| only a matter of time.
| sitkack wrote:
| Israelis have a plan for that in Gaza.
|
| https://www.scientificamerican.com/article/as-israel-
| floods-...
| jancsika wrote:
| I like this idea. But last time I tried it the customer
| representative on the other line told me they were sorry but
| they could not accommodate my request at this time.
| hbn wrote:
| > People who are unwilling to figure out the risks just should
| not use smartphones and the internet.
|
| Sounds great in theory, but just today I was reminded how
| impossible this is when walking back from lunch, I noticed all
| the parking meters covered with a hood, labelled with
| instructions on how to pay with the app.
|
| https://www.cbc.ca/news/canada/saskatchewan/city-of-regina-r...
| plst wrote:
| What do you mean by impossible in this case? Can't you just
| have the coin-operated parking meters back? Where I live, in
| EU, parking meters even take cards.
|
| EDIT: I guess "just" is doing some heavy-lifting, so I won't
| argue this further, but "impossible" isn't the word I would
| use either. The city could revert this decision, definitely
| if enough people wanted them to (that's... I know, the
| hardest part). I just agree with the OP that we technically
| could go back to slightly less-digital society.
| gruez wrote:
| >Regina city council made the decision to remove the coin
| option at downtown meters as part of the budget
| deliberation process, said Faisal Kalim, the City of
| Regina's director of community standards.
| plst wrote:
| Yes, I read the linked article. Yes, the city made this
| decision. The decision could be reverted. I understand
| that this is a type of thing the OP (top-comment in the
| thread) is wishing for.
|
| I don't see the "impossible" in my understanding of the
| linked article.
| TheChaplain wrote:
| Budget-wise it becomes impossible.
|
| Coin-operated meters means someone have to come around
| checking the meter, collect coins, check the parking
| tickets. One person can only cover so many devices per
| day.
|
| Then you have mechanical maintenance, with that comes
| disputes with "it was broken, it didn't accept the money"
| and so forth.
|
| I've probably forgotten a number of other related things,
| but compare the above to digital solution.
|
| Parking app, where the customer pays only for the parked
| time, no fiddling with money or keeping track of time.
| The parking attendant checks much quicker by just
| scanning the license plate while walking the rounds
| (could be done via car and a mounted camera even).
|
| Analog just costs more, and citizens doesn't want taxes
| to go to things that are not strictly necessary.
| plst wrote:
| It was possible for many decades already, budget and
| maintenance-wise. You can at least accept a credit card
| as an alternative. Yes, it's not perfect, but the fully
| digital alternatives also have drawbacks, as pointed by
| OP.
| Spivak wrote:
| I know but you're fighting the cost difference between
| installing CC terminals and QR code stickers.
| fhn wrote:
| "The decision could be reverted." Do you often buy a new
| car and revert that purchase to purchase a different new
| car? I guess you don't often use your own money so no big
| deal.
| plst wrote:
| Why the snark? Did I misread? I don't often buy a new
| car, do you? I really don't understand what your last
| sentence means.
|
| I don't even think this a fair comparison, it's more like
| keeping the old car just in case or for other family
| members. But I think I specified enough what I'm arguing
| already, yes this is unlikely, just not impossible.
| hilliardfarmer wrote:
| They are saying that things that have already been dumbed
| down can't go back. Obviously that's just their opinion,
| but I would guess that most people agree with them.
| prmoustache wrote:
| There are places in EU too where parking meters have
| disappeared and payments are only done through apps. And I
| am talking about public space in the street, not private
| parkings.
| plst wrote:
| I do believe that. Pointing out that I live in the EU was
| completely unnecessary, I meant that I live somewhere in
| the EU, I didn't really mean to compare it to the US.
| shadowgovt wrote:
| No because those cost more to maintain than the digital
| ones. Nobody is restoring the budget that got cut because
| the meters got cheaper.
| fhn wrote:
| no way will they go back to coin-operated. That would mean
| they have to pay employees to walk up and down to collect
| coins.
| jfengel wrote:
| And maintain them, which I suspect costs even more.
| Parking meters do fiddly work, out in all weather, where
| people hate them and do all kinds of vandalism.
|
| It doesn't surprise me that they want to make hardware
| maintenance your problem.
| compass_copium wrote:
| And worst of all, the momey you pay isn't tied to your
| license plate. If you overpay, someone else can park for
| free!!
| skissane wrote:
| Place where I park my car for work (Gosford, Australia)
| just got rid of cash payment, they now take card payment
| only (apparently there is also going to be an app, but they
| haven't launched it yet). I think the number one reason is
| they are upgrading to a new system, and the parking
| technology vendor doesn't provide cash payments as a
| standard option-probably they could implement a custom
| integration to enable it if they thought it was essential,
| but cash payments are so rare, it would be a difficult
| decision to justify. The carpark is owned and operated by
| the local government, so they need to justify their
| decisions, either as commercially viable, or else as
| producing substantial public benefit, but I think both
| arguments would be difficult to sustain in this case.
| b112 wrote:
| It's kinda dumb that you can't tap your card. At least they
| have a phone option, but really, why no CC?
| barbs wrote:
| I'm guessing it's a lot more expensive to install and
| maintain card readers than to essentially just have signs
| prompting people to use their phone.
| mx7zysuj4xew wrote:
| This cuts both ways. Since smartphones are becoming such an
| essential necessity, we should _never_ _ever_ remove the
| possibility to adjust these devices for our own requirements
| nijave wrote:
| I was always under the impression security was a red herring
| and the real reason was control. Google wants to own the device
| and rent it to users with revocable terms the same way SaaS
| subscription software works. Locking down what can run is a key
| step in that process
| browningstreet wrote:
| I worked at a bank on the backend for architecture and
| security.. and I've posted this attestation here before, but
| the sheer volume of fraud and fraud attempts in the whole
| network is astonishing. Our device fingerprinting and no-
| jailbreak-rules weren't even close to an attempt at control.
| It was defense, based on network volume and hard losses.
|
| Should we ever suffer a significant loss of customer identity
| data and/or funds, that risk was considered an existential
| threat for our customers and our institution.
|
| I'm not coming to Google's defense, but fraud is a big,
| heavy, violent force in critical infrastructure.
|
| And our phones are a compelling surface area for attacks and
| identity thefts.
| gzread wrote:
| Then don't issue an app. Issue people cards to pay with and
| let them come to the bank for weird transactions.
| quesera wrote:
| That'd be great, if your goal was to hemorrhage
| customers.
| drnick1 wrote:
| This 100%. I don't understand why everything needs to be
| an app nowadays. Some things are best done in person and
| without to technology. No, I won't install some shitty
| app that requests location and network access to order
| lunch. If a venue does not provide a paper menu and
| accept cash, they have just lost my custom.
| ls612 wrote:
| Do you allow customers to log in to their account with a
| web browser on a windows machine?
| josephg wrote:
| I wish we had technical solutions that offered both. For
| example, a kernel like SeL4, which could directly run
| sandboxed applications, like banking apps. Apps run in this
| way could prove they are running in a sandbox.
|
| Then also allow the kernel to run linux as a process, and
| run whatever you like there, however you want.
|
| Its technically possible at the device level. The hard part
| seems to be UX. Do you show trusted and untrusted apps
| alongside one another? How do you teach users the
| difference?
|
| My piano teacher was recently scammed. The attackers took
| all the money in her bank account. As far as I could tell,
| they did it by convincing her to install some android app
| on her phone and then grant that app accessibility
| permissions. That let the app remotely control other apps.
| They they simply swapped over to her banking app and
| transferred all the money out. Its tricky, because
| obviously we want 3rd party accessibility applications. But
| if those permissions allow applications to escape their
| sandbox, and its trouble.
|
| (She contacted the bank and the police, and they managed to
| reverse the transactions and get her her money back. But
| she was a mess for a few days.)
| JuniperMesos wrote:
| > (She contacted the bank and the police, and they
| managed to reverse the transactions and get her her money
| back. But she was a mess for a few days.)
|
| And this almost certainly means that the bank took a
| fraud-related monetary loss, because the regulatory
| framework that governs banks makes it difficult for them
| to refuse to return their customer's money on the grounds
| that it was actually your piano teacher's fault for being
| stupid with her bank app on her smartphone (also, even if
| it were legal to do so, doing this regularly would create
| a lot of bad press for the bank). And they're unlikely to
| recover the losses from the actual scammers.
|
| Fraud losses are something that banks track internally
| and attempt to minimize when possible and when it doesn't
| trade-off against other goals they have, such as
| maintaining regulatory compliance or costing more money
| than the fraud does. This means that banks - really, any
| regulated financial institution at all that has a
| smartphone app - have a financial incentive to encourage
| Apple and Google to build functionality into their mass-
| market smartphone OSs that locks them down and makes it
| harder for attackers to scam ordinary, unsophisticated
| customers in this way. They have zero incentive to lobby
| to make smartphone platforms more open. And there's a lot
| more technically-unsophisticated users like your piano
| teacher than there are free-software-enthusiasts who care
| about their smartphone OS provider not locking down the
| OS.
|
| I think this is a bad thing, but then I'm personally a
| free-software-enthusiast, not a technically-
| unsophisticated smartphone user.
| SchemaLoad wrote:
| For me the answer is separate devices. I have an iphone
| which is locked down and secure. I have my banking and ID
| apps on it but I can't mod it however I want. Then I have
| a steam deck and raspberry pi I have entertainment and
| whatever I want on. I can customise anything. And if it
| gets hacked, nothing of importance is exposed.
| nijave wrote:
| Web browsers already handle sandboxing
| curt15 wrote:
| > As far as I could tell, they did it by convincing her
| to install some android app on her phone and then grant
| that app accessibility permissions.
|
| Did she make it through the non-google play app install
| flow?
| dwaite wrote:
| Yes, sandboxing is a technological protection, but once
| you have important data flowing we often don't have
| technological protections to prevent exfiltration and
| abuse. The global nature of the internet means that
| someone who publishes an app which abuses user
| expectations (e.g. uses accessibility to provide command
| and control to attackers) is often out of legal reach.
|
| You also have so much grey area where things aren't
| actual illegal, such as gathering a massive amount of
| information on adults in the US via third party cookies
| and ubiquitous third party javascript.
|
| Thats why platforms created in the internet age are much
| more opinionated on what API they provide to apps, much
| more stringent on sandboxing, and try to push software
| installation onto app stores which can restrict apps
| based on business policy, to go beyond technological and
| legal limitations.
| kllrnohj wrote:
| The problem is it's quite easy to poke holes in a sandbox
| when you're outside the sandbox looking in, especially
| when the user is granting you special permissions they
| don't understand. These apps aren't doing things like
| manipulating the heap of the banking app, they are
| instead just taking advantage of useful but powerful
| features like screen mirroring to read what the app is
| rendering.
| EvanAnderson wrote:
| > . For example, a kernel like SeL4, which could directly
| run sandboxed applications, like banking apps. Apps run
| in this way could prove they are running in a sandbox.
| ... Then also allow the kernel to run linux as a process,
| and run whatever you like there, however you want.
|
| This won't work. It's turtles all the way down and it
| will just end up back where we are now.
|
| More software will demand installation in the sandboxed
| enclave. Outside the enclave the owner of the device
| would be able to exert control over the software. The
| software makers don't want the device owners exerting
| control of the software (for 'security', or anti-
| copyright infringement, or preventing advertising
| avoidance). The end user is the adversary as much as the
| scammer, if not more.
|
| The problem at the root of this is the "right" some
| (entitled) developers / companies believe they have to
| control how end users run "their" software on devices
| that belongs to the end users. If a developer wants that
| kind of control of the "experience" the software should
| run on a computer _they_ own, simply using the end user
| 's device as "dumb terminal".
|
| Those economics aren't as good, though. They'd have to
| pay for all their compute / storage / bandwidth, versus
| just using the end user's. So much cheaper to treat other
| people's devices like they're your own.
|
| It's the same "privatize gains, socialize losses" story
| that's at the root of so many problems.
| nijave wrote:
| Yeah, I worked at a bank once. I was told following policy
| and using dependencies with known vulnerabilities so my ass
| was covered was more important than actually making sure
| things were secure (it was someone else's problem to get
| that update through the layers of approval!). Needless to
| say, I didn't last long
| II2II wrote:
| > Ruining Android for everyone to try to maybe help some rather
| technologically-hopeless groups of people is the wrong
| solution.
|
| This isn't about how skilled a person is, it is about tackling
| social engineering. The article gave the example of someone
| posing as a relative, it could also be a blackmail scheme, but
| it could also be the carefully planned takeover of a respected
| open source project (ahem, xz).
|
| What I am saying is this sort of crime affect anyone. We simply
| see more of it among the vulnerable because they are the low
| hanging fruit. Raising the bar will only change who is
| vulnerable. Society is simply too invested in technology to
| dissuade criminals. Which is why I don't think this will work,
| and why I think going nuclear on truly independent developers
| is going to do more damage than good.
| grishka wrote:
| There's quite a gap between this sort of opportunistic
| scamming that's happening all over the world and targeted
| multi-year campaigns that probably require the resources of a
| nation state.
| warkdarrior wrote:
| > targeted multi-year campaigns that probably require the
| resources of a nation state
|
| Ha ha ha, "resources of a nation state"! One could run
| phishing campaigns at scale over many years without
| breaking the bank. This was true before LLMs, it's probably
| even cheaper now.
| grishka wrote:
| Sorry, I keep forgetting that LLMs are a thing. But I
| disagree because many people, especially tech-savvy
| people, can't possibly trust any communication that has
| the hallmarks of slop.
| jnovek wrote:
| At this point it's naive and perhaps a bit dangerous to
| assume that any of us can differentiate LLM from non-LLM
| text. I see less and less recognizable "slop" as time
| goes on, but I doubt the amount of content being
| generated has gone down.
| reaperducer wrote:
| _especially tech-savvy people, can 't possibly trust any
| communication that has the hallmarks of slop._
|
| And yet, people on HN respond to bots all the time.
| II2II wrote:
| True, but that kinda misses the point.
|
| One way to look at it: there are many open source projects
| targeting Android, projects that gain some sense of
| legitimacy over being open source yet have few (if any)
| eyes vetting them. Or, perhaps, the project is legitimate
| but people are getting third-party builds. That is what
| F-Droid does. That is what the developer of a third-party
| ROM does. It would not require the resources of a nation
| state to compromise them. _I am not trying to cast a shadow
| on open source projects or F-Droid here._ I am simply using
| them as an example because I use said software and am
| familiar with that ecosystem. The same goes for any
| software obtained outside of the Play Store, and it 's
| likely worse since there is no transparency in those cases.
| Heck, the same goes for software obtained through the Play
| Store (but we're probably talking about nation state
| resources on that front).
|
| Another way to look at it: we are only considering a
| specific avenue for exploitation here. If you close it off,
| the criminals will look for others. I would be surprised if
| they weren't looking for ways to bypass Google's checks. I
| would be surprised if they weren't looking for weaknesses
| in popular apps. Then there is social engineering. While
| convincing someone to install software is likely desirable,
| it certainly isn't the only approach.
|
| Either way, I don't think Google's approach is solving the
| problem and I think it is going to do a huge amount of
| damage. Let's face it: major corporations aren't a paragon
| of goodness, yet Google's shift is handing them the market.
| xg15 wrote:
| > _People who are unwilling to figure out the risks just should
| not use smartphones and the internet._
|
| That train has left the station decades ago. The internet has
| become an essential part of modern societies. People can't _not
| use the internet_ (or smartphones), at least if they don 't
| live in the woods.
| grishka wrote:
| Have you read my comment in full?
| ceejayoz wrote:
| I have, and I have the same objection. Do you have a
| response to it other than "change society to 15 years ago"?
| grishka wrote:
| No, why should I? I'm not proposing to "change society to
| 15 years ago", my idea is more selective. It's more like
| "do a thorough review and restore all the mechanisms that
| made the use of smartphones and internet optional".
| john_strinlai wrote:
| > _" do a thorough review and restore all the mechanisms
| that made the use of smartphones and internet optional"._
|
| we should probably workshop ideas that are within
| reality.
|
| downvoters are welcome to tell me how they would approach
| a worlwide review of everything that requires internet
| and un-internet it. i will wait.
|
| some primer questions to get your brain turning: who
| organizes and conducts the review? who pays for the
| review? who pays for the implementations? whats the
| messaging and how do you convince people to go along with
| rethinking/re-implementing their entire already-working
| infrastructure that they have potentially spent millions
| to billions of dollars on? do you just dissolve all of
| the internet-only services, and tell the founders to suck
| it? who enforces it and how?
| lejalv wrote:
| "There is no alternative" is a self-fulfilling prophecy
| john_strinlai wrote:
| i am not saying "there is no alternative".
|
| i am saying that you cant do a worldwide systematic
| review of everything that relies on the internet, and un-
| internet it.
|
| if you have a realistic approach to doing so, i will eat
| my shoe.
| grishka wrote:
| If we, the tech-savvy people, start pushing for it, it
| may have a chance of succeeding. On the other hand, if we
| take your defeatist approach, it's an absolute certainty
| that nothing will change.
| john_strinlai wrote:
| just because i disagree with your idea does not mean i am
| taking a "defeatist approach".
|
| your idea is not the One Good Idea that everyone must
| subscribe to or else they must shrug and give up.
|
| but, lets hear it. what specifically is involved in
| "pushing for it"?
| EvanAnderson wrote:
| Consumer protection legislation would be a way to solve
| this:
|
| If a business has more than X employees / does more than
| X amount of business per year / has more than X physical
| locations (pick one or more, make up some new criteria,
| tune to suit the needs of society) it must offer the same
| capabilities to interact with the business to those
| without smart phones as those with.
|
| Small businesses wouldn't be radically impacted because
| they generally aren't "Internet only" anyway. The large
| business that are impacted have plenty of resources to
| handle compliance. If anything I'd argue it levels the
| playing field to an extent.
| croes wrote:
| Given how many tech savvy people here run OpenClaw or one of
| it's copycats I wouldn't be so harsh in my judgment.
| ravenstine wrote:
| This has nothing to do with keeping people safe. If it did then
| power users could continue to install their own software by
| being given that ability as a developer setting. The fact that
| some people are gullible enough to go into a hidden setting on
| their phone and enable that in order to install an app from a
| random Chinese website is not a good reason to take away
| everyone's freedom. Consolidation of power is all this is
| about.
| jrmg wrote:
| _This has nothing to do with keeping people safe._
|
| ...and...
|
| _some people are gullible enough to go into a hidden setting
| on their phone and enable that in order to install an app
| from a random Chinese website_
|
| are kind of contradictory.
| SchemaLoad wrote:
| There is immense pressure to stop online scams which are
| draining old people of their life savings. The whole flow
| from the article seems entirely based around letting power
| users install what they want while being able to break the
| flow of a scammer guiding a clueless person in to installing
| malware.
|
| It is promising that Google has avoided just turning off
| sideloading but still put measures in place to protect
| people.
| hilliardfarmer wrote:
| We used to live in that world! Until the 1970s in the US, you
| actually couldn't take on debt or get a credit card if you had
| no way to repay it. But liberals pushed for a new law that made
| it so anybody could access credit and when you open up systems
| to everyone then the quality goes down dramatically.
|
| We basically do this with everything. Unix is a great operating
| system, but the Mac version, made for morons, is practically
| unusable it's so dumbed down.
| Retr0id wrote:
| I don't know if Google is making the right choice here, but I
| do believe that technology should be for anyone (anyone who
| wants it, at least).
|
| How do you plan to decide who gets to use internet banking and
| who doesn't? That doesn't seem like a good road to be going
| down, either.
| grishka wrote:
| People themselves will decide. Same way they decided whether
| they wanted to buy a computer in the 00s. It's just that
| those who decide to not have internet banking should not be
| disadvantaged by the society compared to those who have it.
| gkoberger wrote:
| I "get" technology so I get how you got here. It's natural for
| me.
|
| But this is the wrong take. I expect to go to a restaurant and
| not die from the food... and I want nothing to do with the
| inner workings of the kitchen. I just want to know any
| restaurant I go into will be safe.
|
| How is that not a fair ask for technology, too? We all have
| things we know well, and then there's reasons we're alive that
| we don't even know exist because someone took care of it.
| bombcar wrote:
| You could torture the analogy more and say that this is more
| like saying "it is possible to make bad food and kill
| yourself at home, so we require everyone to go to a
| restaurant."
| bigbuppo wrote:
| Well, I mean, do you know many houses burn down because
| someone fell asleep while frying a pork chop? We should
| just get rid of kitchens at home because it's just not
| safe.
| lovehashbrowns wrote:
| Oil fires cause immense damage to property and life! I
| don't know why stoves are allowed in homes at all. Worse
| yet, they don't implement any age verification, so a
| child can just turn on the burner! It's crazy!
| econ wrote:
| The unmonitored copying alone!
| TobTobXX wrote:
| I think it is different for some people because they are
| passionate and interested in tech.
|
| I'd imagine someone who is passionate about cooking wouldn't
| be delighted if you cloudn't buy any ingredients in a store.
|
| I see the value in precooked food and black-box working
| technology. But for me myself, as an enthusiast: I like being
| able to tinker and control my technology.
| dminik wrote:
| If you want to cook at home, there's no waiting list. There's
| no popup you have to confirm three times. You buy a stove,
| which likely lasts you half your life, a fridge, some dishes,
| pots, pans and so on.
|
| I think it's fine to give people an easy mode. Not everyone
| cares about cooking (or tech). I just wish companies weren't
| trying to take the advanced features from the rest of us who
| do care.
| mx7zysuj4xew wrote:
| Because no amount of safeguards put up by the restaurant is
| going to protect you from getting sick of you decide to empty
| a bottle of bleach into your meal.
| bloqs wrote:
| This captures the issue well
| grishka wrote:
| Your analogy doesn't work here. Going to a restaurant is like
| using an app store. Installing apks is like cooking at home.
| Nothing stops you from cooking a meal that will get you sick.
|
| Now imagine that every restaurant in your city is owned by
| one of two megacorporations and they really don't want you to
| have a microwave at home, let alone a stove. They expect that
| you will get all your food from them. This is where it's
| going with apps right now.
| Klonoar wrote:
| The ask is fair but the distinction regarding one or two
| companies total being the arbiter of this is the issue.
| fhn wrote:
| you expect a restaurant to be safe but there is no guarantee
| that it is. Many people have had food poisoning and I am sure
| some have died. It is obvious you don't "get" technology at
| all. You don't even "get" restaurants.
| mystraline wrote:
| > At this point I'm convinced that there's something deeply
| wrong with how our society treats technology.
|
| The problem isnt with technology. The problem is with physical
| ownership versus copyright/trademark/patent ownership in
| abeyance of physical ownership.
|
| I go to a store and buy a device. I have a receipt showing a
| legal and good sale. This device isnt mine, even if a receipt
| says so.
|
| The software (and now theres ALWAYS software) isnt mine and can
| never be mine. My ownership is degraded because a company can
| claim that I didn't buy a copy of software, or that its only
| licensed, or they retain control remotely.
|
| And the situation is even worse if the company claims its a
| "digital restriction", ala DMCA. Then even my 1st amendment
| speech rights are abrogated AND my ownership rights are
| ignored.
|
| It would not be hard to right this sinking ship.
| 1. Abolish DMCA. 2. Establish that first sale doctrine
| is priority above copyright/patent/trademark 3. Tax
| these 'virtual property rights' 4. Have FTC find any
| remote control of sold goods be considered as fraudulently
| classified indefinite rental (want to rent? State it as such)
| grishka wrote:
| If you think about it for as long as I did, you will find
| that the moment everything went sideways is when general-
| purpose computing devices started having their initial
| bootloader in the mask ROM of the CPU/SoC. Outlaw _just that_
| , say, by requiring the first instruction the CPU executes to
| physically reside in a separate ROM/flash chip, and suddenly,
| everything is super hackable. But DMCA abolition would
| certainly be very helpful as well.
| shadowgovt wrote:
| > Ruining Android for everyone to try to maybe help some rather
| technologically-hopeless groups of people is the wrong
| solution.
|
| Those groups of people are Google's paying customers. Google
| will, of course, defer to the ones who need more help to be
| safe online over the ones who don't. That's how you create a
| safe ecosystem.
| dzikimarian wrote:
| What's then left as Google's advantage? I'm really not
| interested in buying myself a cage, but if Google will make
| me choose between two cages then Apple has nicer one.
| shadowgovt wrote:
| Google still doesn't make you pay s dollar to write an app
| on their architecture (only to have it hosted in their
| store).
| themacguffinman wrote:
| How is it unsustainable when iOS has enforced even stricter
| rules for its nearly 20 year lifespan?
| etiennebausson wrote:
| There two main mobile OS in the space, one moron-proof but
| limited, the other a bit more permissive, but slightly less
| secure for it.
|
| The problem is that most apps target only those two, and the
| second is trying to moron-proof, loosing most of it value to
| part of its users, while the apps are still locked in.
| grishka wrote:
| Android has about 2/3 worldwide market share and it hasn't
| had anything like this before. Many people, myself included,
| chose it exactly _because_ it allows the installation of
| modded, pirated, or otherwise non-store-worthy apps.
| VladVladikoff wrote:
| >Ruining Android for everyone
|
| Are they really though? does the average person really care
| about side loading? I think we are in an echo chamber. I can't
| picture any of the people in my life installing things from
| outside of an app store on their phone. However I realize
| that's purely anecdotal, it would be nice to see actual
| statistics on this to have a more informed decision.
| monocasa wrote:
| When I point out that Apple listened to the Chinese
| government and removed apps that protestors were using to
| communicate during the Hong Kong protests, they seem to get
| it.
| otabdeveloper4 wrote:
| This "sideloading" thing is mostly to enforce US sanctions
| against countries like China, Russia and Iran.
|
| So yes, hundreds of millions of people care about this.
| cxr wrote:
| It sounds like you're not grasping the meaning of the
| linguistic construction being used by the person you're
| quoting. (Or you're being deliberately deceptive about your
| understanding of their intent. But it's probably just the
| former. I'm guessing you're ESL.)
|
| "Ruining Android for everyone" ( _" to try to maybe help
| some"_) does not mean, "Android is now ruined for X, for all
| X." It means, perhaps confusingly, pretty much the opposite.
|
| It means: "There exists some X for which Android is now
| ruined (because Google is trying to protect Y, for all Y)."
| (Yes, really. The way the other person phrased it is the
| right way way to phrase it--or, at least, it's a _valid_ way
| to phrase it.)
| GeekyBear wrote:
| > People who are unwilling to figure out the risks just should
| not use smartphones and the internet
|
| People who aren't technically sophisticated should choose the
| smartphone ecosystem that was designed to offer the safety of a
| walled garden from the start.
|
| Google sold Android as the ecosystem that gave users the
| freedom to do anything they like, including shooting themselves
| in the foot.
|
| Google should not be allowed to fraudulently go back on their
| promise now that they have driven the other open ecosystems out
| of the marketplace.
| skybrian wrote:
| No, you have that backwards. A society is judged by how it
| treats its least able members. Android devices are primarily
| for mainstream users, not us. Technically adept users are the
| minority and we can deal with a few hoops to customize our
| phones the way we like.
|
| It's selfish to advocate against better protections for the
| least able people in the world just for our own convenience.
| Wowfunhappy wrote:
| Could the technophobes please just buy different smartphones?
| If certain people want to opt in to locked down devices, I
| think that's okay. But please give me a device that lets me do
| whatever I want. (And still lets me participate in modern
| society--I can't live with a Linux phone).
|
| Apple's argument for locking down the iPhone but not the Mac
| has always been some variation of "Mac users are professionals
| and iPhones are for everyone." Fine! Where can I buy the
| unrestricted iPhone? As far as I'm concerned, basically every
| problem could be solved if Apple would put the Security
| Research Device on an unlisted page of their online store for
| the general public. Normies won't buy it, and I will.
| dwaite wrote:
| We already have that. The market for the "technophobe" (e.g.
| above average and below levels of security awareness) phone
| is 100x larger.
|
| That means the people who say "I can evaluate the intricacies
| and impacts of software authorization" have significantly
| fewer speciality devices to pick from, and those devices may
| not be worth developers (or regulators) making carve-outs to
| support.
| SchemaLoad wrote:
| You can do that, there are custom roms and open source
| phones. The problem is banks are legally obligated a lot of
| the time to pay out for fraud and scams. So in response they
| won't allow you to run their software unless they can verify
| the compute environment.
| wat10000 wrote:
| Smartphones and the internet are really useful and convenient.
| Even if we could make it work, it seems quite rude to say that
| people should be excluded from it because we can't be bothered
| to make it safe.
|
| Consider an older technology that became fundamental to much of
| daily life a century or two ago: writing. After a few millennia
| where literacy was a specialized skill, we pretty quickly
| transitioned to a society where it was essential for common
| activities. Rather than make sure everything had pictures and
| such to accommodate the illiterate, we tried to make it so that
| the entire population is literate, and came pretty close to
| succeeding. There are people who just outright can't read for
| whatever reason, but they're a very small minority and we aim
| to accommodate them by giving them assistance so they can get
| by in a literate world, rather than changing the world so you
| don't need to be able to read to live a normal life.
|
| Rather than saying that half the population (a low estimate, I
| believe, for how many people will fall prey to malware in an
| anything-goes world) should abandon this technology, we should
| work to make it so they don't have to, with some combination of
| education and technological measures.
| grishka wrote:
| Some people don't want to be taught about some things because
| they don't care enough about them. I was told a story as a
| kid about a grandma that didn't _want_ to learn to read and
| write. It 's the same thing here -- there are people who
| don't _want_ a smartphone. They were just fine with an old
| cell phone that could only call and text, but then the
| society forced them to buy a smartphone, so they did, but
| they still don 't really want it. It's still a burden to
| them. It still creates more problems for them than it solves.
| I know several people like that.
| alexchapman wrote:
| Or people just learn it and if they screw up they learn from
| those mistakes.
| derefr wrote:
| > to try to maybe help some rather technologically-hopeless
| groups of people
|
| Even if they're the majority?
|
| (Keep in mind that as average lifespan keeps getting longer
| while birth rates keep going lower, demographics will tend to
| skew older and older. Already happened in Japan; other
| developed countries will catch up soon.)
|
| > They should probably not have a bank account at all and just
| stick to cash.
|
| You know that these people (mostly) aren't cognitively-
| impaired, right? Mostly, they were just introduced to these
| kinds of technologies at such a late time in their life that
| they were at least in full swing of the late phase of their
| career, and so had both no time and no attention to focus on
| adapting their mental paradigm to the one these technologies
| expect/require. They still fully understand and can make fluent
| use of older technologies that they _did_ absorb and adapt to
| earlier in their lives.
| politelemon wrote:
| I'm not in agreement with most of you, hn. They've found a decent
| compromise that works for power users and the general population.
| Your status as a power user does not invalidate the need to help
| the more vulnerable.
|
| Having to wait a day for a one off isn't a big deal, if they kept
| it looser then you'd be shouting about the amount of scams that
| propagate on the platform.
| varispeed wrote:
| But this is very rich from them given they serve scam ads with
| impunity.
|
| I'd say this has nothing to do with preventing scams, but to
| make independent software more difficult to distribute.
| keanebean86 wrote:
| My personal hard line is having to ask Google for permission to
| sideload. Even if it's free and no personal info is exchanged.
| This new process is annoying but I can see it helping prevent
| scams.
| t_mahmood wrote:
| Same with bootloader unlocking isn't it?
|
| Ah, its not much, just an email away ...
|
| oh, not much it's email and a phone call away ...
|
| Just wait 7 days ... no, it's just a month, and only one device
| par account? What's wrong with it? You are overreacting
|
| Wait! Why you want to unlock your boot loader, only 0.000001%
| does it. You are abnormal, not the mass user
|
| Fool me once it's on you Fool me twice ... it's on me.
|
| We are already over twice, but none the wiser.
| nolist_policy wrote:
| You can buy a Pixel instead of a Xiaomi.
| t_mahmood wrote:
| Why would I pay Google after this? I have gotten rid of
| Xiaomi a long time ago.
|
| For now, I am rolling with my OnePlus 7 with LineageOS,
| till I find a phone that's not completely locked down. Yes,
| it's old, but it gets my job done. Once I am off all of
| Google's services, I'll probably get rid of Google in most
| part of my life.
|
| As, someone who is a user from invite only Gmail, it's
| difficult, but necessary.
| izacus wrote:
| All Google Pixel phones still have unlockable and resignable
| bootloader.
| t_mahmood wrote:
| Um, I am sorry, in the current context, Why do you think of
| all, we still pay Google? :-)
| kace91 wrote:
| >Having to wait a day for a one off isn't a big deal
|
| It's my phone. It's my software. Period.
|
| The general population is deterred by burying a setting deep.
| Waiting is a dark pattern and we're not idiots.
| Kwpolska wrote:
| Scammers can coerce people into ignoring warnings if they
| convince them their entire life savings are on the line. It's
| hard to do if you need to wait 24 hours before the setting
| unlocks.
| allreduce wrote:
| This helping the vulnerable framing is naive at best. This is
| about an American ad company consolidating their power over
| what people can do with devices they bought and are reliant on
| daily.
|
| Helping the vulnerable should not involve that. If your only
| idea on how to help the vulnerable involves that, think of
| better ideas.
| dandellion wrote:
| At some point we need to start wondering if it's not just
| naivete but intellectual dishonesty. The same American
| corporations that claim to be imposing draconian control
| measures to "protect the vulnerable" are, at the same time,
| exploiting those very same vulnerable people to the best of
| their ability. Take Google, they have no problem showing ads
| for scams in Youtube and Google Ads. There is mounting
| evidence that their recommendation algorithms for Youtube,
| shorts, etc. negatively affect mental health, especially
| youngest ones. But it makes them money, and they've zero
| interest in preventing that or changing it.
|
| And it's not just Google, it's the m.o. of all large
| corporations. Another example is Epic Games, they advertise
| how they will fight in court against big companies like
| Google and Apple to defend their users. Yet they've gotten
| fined repeatedly for amounts in the millions, for predatory
| micro-transactions, and misleading minors into spending money
| without the consent of their parents.
|
| Time and time again it is proven that everything these
| companies do, it's always for the benefit of their bottom
| line, and consideration for their users does not even factor
| into their considerations. This is no different, they want to
| push it because it will give them more control or make them
| money, and it either won't protect anyone, or that's just an
| unintended side effect but a good way to market it.
| andyjohnson0 wrote:
| I'd rather not have to go through this ritual, but I appreciate
| that there is a genuine security problem that google are trying
| to address. I also suspect that they have other motivations
| bound-up in this - principally discouraging use of alternative
| app stores. But basically I could live with this process.
|
| Yeah, I know... Stockholm syndrome...
|
| Although I may not have to live with it, as none of my present
| devices are recent enough to still receive ota updates.
|
| Context: I don't use alternative app stores. I occasionally side-
| load updates to apps that I've written myself, and very
| occasionally third party apps from trusted sources.
| fluidcruft wrote:
| I don't think developers targeting alternative app stores would
| care much about having to perform verified developer
| registration. Particularly apps that are available in both Play
| Store and alternative app stores.
| anonym29 wrote:
| >And what is malware? For [Android Ecosystem President], malware
| in the context of developer verification is an application
| package that "causes harm to the user's device or personal data
| that the user did not intend."
|
| Like when Google, Facebook, Apple, Microsoft, et al. cooperated
| with1 the unconstitutional and illegal2 PRISM program to hand
| over bulk user data to the NSA without a warrant? That kind of
| harm to my personal data that I did not intend?
|
| If so, I'd love to hear an explanation of why every
| Google/Alphabet, Facebook/Meta, and Microsoft application haven't
| been removed for being malware already.
|
| 1 https://www.theguardian.com/world/2013/jun/06/us-tech-giants...
|
| 2 https://www.reuters.com/business/media-telecom/us-court-mass...
| nullc wrote:
| I'd urge everyone here to seriously consider switching to
| GrapheneOS. It's a _far simpler_ transition than e.g. switching
| from Windows or OSX to Linux, and many people find that it has
| basically no friction vs android.
|
| More people moving to GrapheneOS is the best tool we have against
| Google's continued and escalating hostility to user freedom and
| privacy and general anti-competitive conduct. (Of course, you
| could ditch having a smartphone entirely..., but if you're
| willing to consider that you don't need me plugging an
| alternative).
| beepbooptheory wrote:
| I get that its pretty clear with the straight sideloading case,
| but can anyone say for sure what this will look like for an
| f-droid user? Its hard to keep track but I thought something new
| here because of EU is that alternative app stores != sideloading?
| Something where app stores could choose themselves to get
| "verified," whatever that means, to become a trusted vendor? Or
| is this completely wrong?
| RIMR wrote:
| I am not happy about this, but as long as advanced Android users
| can still turn this off and keep it off, we're still in a better
| place than iOS.
|
| Even though I understand the design decisions here, I think we're
| going about this the wrong way. Sure, users can be pressured into
| allowing unverified apps and installing malware, and adding a
| 24-hour delay will probably reduce the number of victims, but
| ultimately, the real solution here is user education, not
| technological guardrails.
|
| If I want to completely nuke my phone with malware, Google
| shouldn't stand in my way. Why not just force me to read some
| sort of "If someone is rushing you to do this, it is probably an
| attack" message before letting me adjust this setting?
|
| Anyone who ignores that warning is probably going to still fall
| for the scam. If anything, scammers will just communicate the new
| process, and it risks sounding even more legitimate if they have
| to go through more Google-centric steps.
| egorelik wrote:
| As an idea, what about allowing the 24 hours to be bypassed using
| adb (edit: bypass to allow indefinitely, not just install a
| single app)?
|
| I understand there is some problem trying to be solved here, but
| honestly this is still quite frustrating for legitimate uses. If
| this is the direction that computing is moving, I'd really rather
| there were separate products available for power users/devs that
| reflected our different usage.
| pie_flavor wrote:
| This is already how it works.
| gumby271 wrote:
| Right, if this is being built into AOSP I dont see how they
| wouldn't add an adb command to immediately skip the "Advanced
| Flow" wait. if it's safe to let uses run "adb install", then
| "adb skip-advanced-flow" should be just as safe to do too.
| basilikum wrote:
| As an idea, what about letting me install on my own device
| whatever I want?
|
| This is ridiculous. Google is trying to dismantle the concept
| of ownership and personal autonomy. Do not give them any
| ground.
| Aachen wrote:
| I'm surprised but happy to see you and so many others here
| saying this. In recent years it seemed like this 'hacker'
| community was all about Apple devices, but now that Google is
| going partway in the same direction, people aren't all just
| taking it.
|
| Do you think there's two groups, and the people that cared
| simply went with Android and so there was never this outcry
| about installing free software on iOS, or that this will last
| only as long as the change still feels recent and like a new
| restriction?
| aftergibson wrote:
| Nothing screams being infantilised by your platform more than
| having to wait 24 hours to be allowed to install software on your
| own purchased computing devices.
| w4rh4wk5 wrote:
| I'll repeat my question from a while ago. Is the official Temu
| app, available on the Play Store, still full of questionable
| malware / spyware code?
|
| If so, it's clear that none of these changes are actually to
| protect users.
| NooneAtAll3 wrote:
| is it 24 hour per app or to enable sideloading at all?
| Groxx wrote:
| From my read, it's explicitly a one-time thing. Presumably that
| means that even if you pick the "allow for 7 days" option, you
| can re-enable it after that without a delay (maybe with a
| reboot?).
| widowlark wrote:
| I switched to iOS in anticipation of this change. The reality is,
| if they are thinking about doing this, it's only a matter of time
| before they do it. If I have to choose between two walled
| gardens, apple will win every time.
| drnick1 wrote:
| Apple is just as bad, you should have switched to Graphene and
| retained the good aspects of Android without the parts that
| suck (Google).
| widowlark wrote:
| I love and use graphene regularly on my pixel devices
| gumby271 wrote:
| > In addition to the advanced flow we're building free, limited
| distribution accounts for students and hobbyists. This allows you
| to share apps with a small group (up to 20 devices) without
| needing to provide a government-issued ID or pay a registration
| fee.
|
| I don't quite understand how those installs would be tracked. If
| I create a "hobbyist" account and share the apk, are the devices
| that install that app all reporting it to Google? To my
| knowledge, Google only does this through the optional Play
| Protect system, is that now no longer optional? I'd like to know
| if my computer is reporting every app I install up to Google.
| kykat wrote:
| You thought it wasn't reporting every app you install?
| gumby271 wrote:
| I mean, I'm happy to be conspiratorial about it too, I give
| Google no benefit of the doubt, but outside of Play Protect I
| don't think they explicitly say "your phone is telling us
| every app you install." This new feature is them making that
| explicit.
| benatkin wrote:
| Funny how that post doesn't mention that a huge amount of malware
| is downloaded from Google (from the Chrome Web Store as well as
| from Google Play).
| surgical_fire wrote:
| > Wait 24 hours
|
| Man, fuck Google. I hope this bullshit is struck down by
| government regulation as malicious compliance to 3rd party app
| stores.
|
| I wonder if GrapheneOS will have the same level of user-hostile
| bullshit. That may be my salvation board right now.
|
| Sailfish OS would be great, but unfortunately my banks don't seem
| to play along with it.
| Retr0id wrote:
| They should let you skip the wait if you're setting up a device
| for the first time.
| fluidcruft wrote:
| I think that's a good point. When you're playing around
| flashing ROMs it's going to get really old, really fast.
| grishkno wrote:
| That's similar to the process of enabling developer options on
| Xiaomi phones, for the last 5 years
| fdghrtbrt wrote:
| Reminder that when you use terminology like "sideloading" you're
| accepting the premise that there's something inherently dodgy
| about installing your software onto your operating system.
|
| Just call it "installing".
| kykat wrote:
| Don't use the enemy language
| jwlake wrote:
| If android security is so fucked that the 24 hours helps, why do
| they maintain it has security?
| pmdr wrote:
| > Balancing openness and choice with safety
|
| No, I'm afraid this is tipping the scale of control in Google's
| favor.
| darkwater wrote:
| They have now successfully turned the temperature knob from 2 to
| 5. I wonder what 7 will be.
| modeless wrote:
| Hmm, as long as the waiting period is not per-app then maybe this
| is OK. Especially now that there is a well supported way to
| distribute alternative app stores without going through the
| sideloading process.
| macinjosh wrote:
| The secret reason they are doing this is because governments want
| to be able to identify everyone online everywhere it matters at
| all time. They want to strip anonymity from computing.
|
| Apple and Google can now credibly claim to governments to have
| nearly ubiquitous computing platforms that they can guarantee do
| not run any software that is not approved or antithetical to the
| goals of authorities. This makes the device safe for storing
| things like government IDs. OSs and Browsers will be required to
| present these IDs or at first just attest to them.
|
| Before posting online, renting a server, using an app you will
| have to idenitfy yourself using your phone or similarly locked
| down PC (i.e. mac).
|
| The introduction is under the guise as always of protecting the
| children. In reality they are removing your rights to privacy and
| free speech.
| jacquesm wrote:
| Malicious compliance.
| prmoustache wrote:
| This is ridiculous, most malware is shipped by google itself
| through the playstore.
| spwa4 wrote:
| What? No requirement to personally bring in a form in triplicate
| to the Google office in Siberia, of course notarized by the Pope
| and Zendaya, and simply prove it was signed on the moon.
| shadowgovt wrote:
| So can it be breached by turning off networking and setting the
| date forward a couple days?
| quyleanh wrote:
| Tbh, I love this flow. They truely think for users, all users not
| just advanced users. Unlike Apple, Apple just think for its
| ecosystem, its money. How the advanced flow works
| for users Enable developer mode in system settings:
| Activating this is simple. This prevents accidental triggers or
| "one-tap" bypasses often used in high-pressure scams.
| Confirm you aren't being coached: There is a quick check to make
| sure that no one is talking you into turning off your security.
| While power users know how to vet apps, scammers often pressure
| victims into disabling protections. Restart your phone and
| reauthenticate: This cuts off any remote access or active phone
| calls a scammer might be using to watch what you're doing.
| Come back after the protective waiting period and verify: There
| is a one-time, one-day wait and then you can confirm that this is
| really you who's making this change with our biometric
| authentication (fingerprint or face unlock) or device PIN.
| Scammers rely on manufactured urgency, so this breaks their spell
| and gives you time to think. Install apps: Once you confirm
| you understand the risks, you're all set to install apps from
| unverified developers, with the option of enabling for 7 days or
| indefinitely. For safety, you'll still see a warning that the app
| is from an unverified developer, but you can just tap "Install
| Anyway."
| viktorcode wrote:
| Judging by the comments sideloading plays a major part in
| everyone's life. What apps do you sideload guys? Why those apps
| are not in a store?
| rcMgD2BwE72F wrote:
| Would Obtainium continue to work? I like the freedom of
| entrusting developers I know and installing APKs from
| repositories instead of restricting myself to app stores whose
| publishers have to be identified and approved by an advertising
| company.
|
| Can I keep this freedom?
| wasting_time wrote:
| I install from F-Droid when possible. It has less noise, and
| all apps are free as in software.
|
| There are some true gems such as:
| justagiirl wrote:
| > What apps do you sideload guys?
|
| I sideload no apps. I install most apps from either F-Droid
| main, or an other repo.
|
| > Why those apps are not in a store?
|
| All of them are in a repository. Just only the state sponsored
| ID-app is only available via the ad-infected Google RAT
| delivery service, also known as Google Play.
| Macha wrote:
| F-Droid. And also by Google's definition, everything I install
| from F-Droid. So Antennapod (Podcasts), ConnectBot, DAVx (sync
| my Fastmail calendar to my phone), Etar (Calendar app),
| Jellyfin (media player), Jiten (JP dictionary), KOReader (ebook
| reader), OsmAnd~ (Maps), VLC.
|
| Meanwhile from the Play Store I have Bitwarden, Firefox, 2
| banking apps, a few airline apps, Wireguard and Whatsapp. So I
| actually have more from F-Droid than the Play Store from what I
| regularly use.
| notrealyme123 wrote:
| they even say that you can allow sideloading temporary or
| indefinitely. Guess which option wont be available anymore in two
| years.
| PieUser wrote:
| So convoluted... that's all I gotta say.
| bityard wrote:
| Welp, I guess my current Android phone will be my last one.
|
| At least half of the apps I use on a daily basis come from
| f-droid. This enforced 24-hour wait is simply not acceptable.
| Android has always been a far inferior overall user experience
| compared to iPhone. Android's _only_ saving grace was that I
| could put my own third-party open-source apps on it. There is
| nothing left keeping me on Android now.
|
| I'll probably get an iPhone next, but I do sincerely hope this
| hastens progress on a real "Linux phone" for the rest of us.
| Plasma Mobile (https://plasma-mobile.org) looks very nice indeed.
| I'll be more than happy to contribute to development and funding.
| mikescandy wrote:
| If I understand correctly, the 24 hour wait is a one off. After
| the sideloading feature is enabled, it should stay on.
| kykat wrote:
| 24-hour wait is a one time setup, I'd imagine that fdroid will
| keep working as usual after this super hidden don't enable me
| option is enabled.
| MishaalRahman wrote:
| If it helps, the 24-hour wait is a one-time process. You do it
| once, click the toggle to allow installing unregistered apps
| indefinitely, and then install whatever you want. You can even
| turn off developer options afterwards, per my understanding,
| and it won't impact your ability to install unregistered apps.
| Acrobatic_Road wrote:
| For now.
| applfanboysbgon wrote:
| That does not help. That is a fundamentally fucking insane
| limitation that will completely destroy any developer's
| ability to develop without getting approval from Google.
| Regardless of my feelings of the annoyance of going through
| this process myself, 90% of users simply _will not_ go
| through this process to install apps, killing any potential
| userbase. Google has no goddamn right to be the sole dictator
| of who is allowed to develop software for the largest
| platform in the world, to decide who is allowed to have a
| career in mobile software development and who is not, and you
| should be utterly ashamed of yourself for accepting a
| paycheck to defend this. I hope your shitty company and Apple
| both get their comeuppance in court for these monopolistic
| practices, and may we some day get a future where anyone is
| free to develop software without approval of a third party.
| NoahZuniga wrote:
| Probably f droid will become an official app store recognized
| by Google, and then you won't have to go through this flow to
| install f droid or its apps.
| Aachen wrote:
| Have you read their blog on the topic? It's the end of the
| project
| tavavex wrote:
| The part in the flow where you select between allowing app
| installs for 7 days or forever is a glimpse into the future. That
| toggle shows the thought process that's going on at Google.
|
| I can bet that a few versions down the line, the "Not
| recommended" option of allowing installs indefinitely will become
| so not recommended that they'll remove it outright. Then shrink
| the 7 day window to 3 days or less. Or only give users one
| allowed attempt at installing an app, after which it's another 24
| hour waiting period for you. Then ask the user to verify
| themselves as a developer if they want to install whatever they
| want. Whatever helps them turn people away from alternatives and
| shrink the odds of someone dislodging their monopoly, they will
| do. Anything to drive people to Google Play only.
| wlesieutre wrote:
| Pay verification fee to continue
| observationist wrote:
| >"PLEASE DRINK VERIFICATION CAN TO CONTINUE"
| andai wrote:
| Context: https://files.catbox.moe/eqg0b2.png
|
| I think they later made a Black Mirror episode along these
| lines. _" Resume viewing... Resume viewing..."_
| ForHackernews wrote:
| > Install apps: Once you confirm you understand the risks, you're
| all set to install apps from unverified developers, with the
| option of enabling for 7 days or indefinitely. For safety, you'll
| still see a warning that the app is from an unverified developer,
| but you can just tap "Install Anyway."
|
| If you can enable this once, forever, after a 24 hour cooldown
| period I don't hate this as much as I hated some of the other
| proposals from Google. It'll just be something you do as part of
| the setup for a new phone.
| IamDaedalus wrote:
| the best marketing apple has received in a long; death by self
| sabotage
| lenerdenator wrote:
| And now we see why Android never really was Linux.
|
| Does it have a Linux kernel? Of course. But this isn't a free
| operating system.
| fhn wrote:
| All these vibe coders and we're still stuck with Google and
| Apple. This is what you get with a duopoly
| ptrl600 wrote:
| Hey, the user doesn't need a Google account, that's good. Still a
| danger of frog boiling but not as bad as I was expecting.
| sunaookami wrote:
| Whoever worked on this: Thank you for your killing open
| computing. I hope you are proud and don't spend all the money at
| once.
| 2001zhaozhao wrote:
| I think the new solution is a good compromise.
|
| The 7 days vs forever choice is still crappy and gives me a bit
| of bad vibes considering they are the ones that pulled the
| youtube promotions (shorts, games) you can never turn off
| forever, so there's the concern they will remove the forever
| option from Android in the future. But as long as they don't end
| up doing that, it's fine for me.
|
| Also, I do think it would be a good idea to make an exception to
| the 24-hour wait time if the phone is new enough (e.g. onboarding
| steps were completed less than one day ago), and/or through some
| specific bypass method using ADB. Power users who get a new phone
| want to set it up with all their cool apps and trinkets right
| away, and it's not good user experience to have to use ADB to
| install every single sideloaded app. Meanwhile a a regular user
| getting scammed right after getting a new phone is statistically
| unlikely.
| guilhas wrote:
| Some years ago had a scam call about my "router connection error
| logs" and "I needed" to install TeamViewer from the PlayStore...
| So can't imagine what is this going stop
| arendtio wrote:
| 24H forced wait time?!? WTF
|
| When I side-load open-source apps for other people, I want to do
| it right in the moment, not activate the feature, and the next
| time I see them (like half a year later), install the app.
|
| When Google announced there would be an alternative installation
| method, I did not expect such a mess...
| basilikum wrote:
| A lot of people here are looking for compromises. Any compromise
| on this means giving ground to Google's monopoly and the war on
| open computing and ultimately freedom.
|
| This is exactly what Google intended. This is why they started
| off by announcing completely removing device owner chosen
| installs (this is not side loading! It's simply installing.) and
| announced only apps allowed by Google would be available for
| install.
|
| They knew it would cause backlash. They anticipated that and
| planned ahead faking a compromise.
|
| They are trying to boil us like frogs by so slowly raising the
| temperature so we do not notice. Whenever the water gets so warm
| that people do notice they cool it down a little. But they will
| turn up the the heat again!
|
| This 24h window is designed to make device owner controlled
| installs as unattractive as possible. They try to reduce it as
| much as they can while having plausible deniability ("You can
| still install apps not whitelisted by us"). They want to get the
| concept of people installing software of their own choice onto
| their own device as far away from the mainstream as possible.
| They want to marginalize it. They want to slowly and quietly kill
| off the open Android app ecosystem by reducing the user base.
|
| The next step will be them claiming that barely anyone is
| installing apps not signed by them anyway. First they make people
| jump through ridiculous hoops to install non whitelisted apps,
| then they use the fact that few people jump through these hoops
| to justify removing the ability altogether.
|
| Google does not care about preventing scams. If they did they
| would do something against the massive amount of scam ads that
| they host. Scams are just their "think of the children".
|
| Do not play by their playbook!
|
| Do not give them ground!
|
| We must not accept _any_ restrictions on the software we run on
| our own devices. The concept of ownership, personal autonomy and
| choice are being dismantled. Our freedom is the target of a slow,
| long waging war. This is yet another attack.
|
| We must not compromise with the attacker. We must not give them
| any centimeter of ground.
| user34283 wrote:
| It's 2026 and regulators are finally getting around to do
| something about the mobile app distribution chokehold.
|
| And Google thinks they can pull this? I hope regulators make it
| very clear that this is the wrong direction, and with record
| fines.
| medhir wrote:
| _taps the sign_ : https://medhir.com/blog/right-to-root-access
___________________________________________________________________
(page generated 2026-03-19 23:00 UTC)