Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

101–110 of 694 posts

Re: Android developer verification: Early access starts

#101

Post by Zak »

svat wrote: post #65
Lammy wrote: post #17

Earlier quoted context omitted.

Google have their own reasons too. They would love to kill off YouTube ReVanced and other haxx0red clients that give features for free which Google would rather sell you on subscription. Just look at everything they've done to break yt-dlp over and over again. In fact their newest countermeasure is a frontpage story right beside this one: https://news.ycombinator.com/item?id=45898407

I can easily believe that Google's YouTube team would love to kill off such apps, if they can make a significant (say ≥1%) impact on revenue. (After all, being able to make money from views is an actual part of the YouTube product features that they promise to “creators”, which would be undermined if they made it too easy to circumvent.) But having seen how things work at large companies including Google, I find it l…

I would like a world where buying something means you get final say over how it operates even if you might do something dangerous/harmful/illegal.

Re: Android developer verification: Early access starts

#102

Post by klabb3 »

themafia wrote: post #3

> Keeping users safe on Android is our top priority. I highly doubt this is your "top" priority. Or if it is then you're gotten there by completely ignoring Google account security. > intercepts the victim's notifications And who controls these notifications and forces application developers to use a specific service? > bad actors can spin up new harmful apps instantly. Like banking applications that use push or SMS…

> > intercepts the victim's notifications

> And who controls these notifications and forces application developers to use a specific service?

Am I alone in being alarmed by this? Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps? And they must instead rely on centralized control to disable those apps after the crime? So.. what’s the point of the sandboxing - if this is just desktop level lack of isolation?

Glossing over this ”detail” is not confidence inspiring. Either it’s a social engineering attack, in which case an app should have no meaningful advantage over traditional comms like web/email/social media impersonation. Or, it’s an issue of exploits not being patched properly, in which case it’s Google and/or vendor responsibility to push fixes quickly before mass malware distribution.

The only legit point for Google, to me, is apps that require very sensitive privileges, like packet inspection or OS control. You could make an argument that some special apps probably could benefit from verification or special approvals. But every random app?

Re: Android developer verification: Early access starts

#103

Post by edent »

LoganDark wrote: post #83
svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

It's not possible to provide a path for advanced users that a stupid person can't be coerced to use. Moreover, it's not possible to provide a path for advanced users that a stupid person won't use by accident, either. These are what drive many instances of completely missing paths for advanced users. It's not possible to stop coercion or accidents. It is literally impossible. Any company that doesn't want to take the…

Android could have, for example, a 24 hour "cooling off" period for sideloading approval. Much like some bootloader unlocking - make it subject to a delay.

That immediately takes the pressure off people who are being told that their bank details are at immediate risk.

Re: Android developer verification: Early access starts

#104

Post by hekkle »

BrenBarn wrote: post #24
themafia wrote: post #3

> Keeping users safe on Android is our top priority. I highly doubt this is your "top" priority. Or if it is then you're gotten there by completely ignoring Google account security. > intercepts the victim's notifications And who controls these notifications and forces application developers to use a specific service? > bad actors can spin up new harmful apps instantly. Like banking applications that use push or SMS…

Their top priority is making money.

BINGO! Google doesn't care at all about user security.

- Just yesterday there was a story on here about how Google found esoteric bugs in FFMPEG, and told volunteers to fix it.

- Another classic example, about how Google doesn't give a stuff about their user's security is the scam ads they allow on youtube. Google knows these are scams, but don't care because they there isn't regulation requiring oversight.

Re: Android developer verification: Early access starts

#107

Post by devsda »

Aurornis wrote: post #47
metadat wrote: post #31

Earlier quoted context omitted.

So.. all this drama over an alert(yes/no) box? Wow, this really pulls back the veil. This Vendor (google) is only looking out for numero uno.

> So.. all this drama over an alert(yes/no) box? The angry social media narratives have been running wild from people who insert their own assumptions into what’s happening. It’s been fairly clear from the start that this wasn’t the end of sideloading, period. However that doesn’t get as many clicks and shares as writing a headline claiming that Google is taking away your rights.

> The angry social media narratives have been running wild from people who insert their own assumptions

There may have been exaggerations in some cases but these hand wavy responses like "you can still do X but you just can't do Y and Z is now mandatory" or "you can always use Y" is how we got to this situation in the first place.

This is just the next evolution of SafetyNet & play integrity API. Remember how many said use alternatives. Not saying safetynet is bad but I don't believe their intentions were to stop at just that.

Re: Android developer verification: Early access starts

#108

Post by cesarb »

thisislife2 wrote: post #88
svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

I don't buy this argument at all that this specific implementation is under pressure from the government - if the problem is indeed malware getting access to personal data, then the very obvious solution is to ensure that such personal data is not accessible by apps in the first place! Why should apps have access to a user's SMS / RCS? (Yeah, I know it makes onboarding / verification easy and all, if an app can acces…

> Why should apps have access to a user's SMS / RCS?

It could be an alternative SMS app like TextSecure. One of the best features of Android is that even built-in default applications like the keyboard, browser, launcher, etc can be replaced by alternative implementations.

It could also be a SMS backup application (which can also be used to transfer the whole SMS history to a new phone).

Or it could be something like KDE Connect making SMS notifications show up on the user's computer.

Re: Android developer verification: Early access starts

#109

Post by Zak »

cesarb wrote: post #92
metadat wrote: post #31

Earlier quoted context omitted.

So.. all this drama over an alert(yes/no) box? Wow, this really pulls back the veil. This Vendor (google) is only looking out for numero uno.

> So.. all this drama over an alert(yes/no) box? A simple yes/no alert box is not "[...] specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer". In fact, AFAIK we already have exactly that alert box. No, what they want is something so complicated that no muggle could possibly enable it, either by accident or by being guided on the ph…

I imagine what they're going to do involves a time delay so a scammer cannot wait on the phone with a victim while they do it.

Re: Android developer verification: Early access starts

#110

Post by dgoldstein0 »

gpm wrote: post #14

8 days ago Google and Epic announced a proposed settlement and modification of a permanent injunction that Epic won, I believe this proposed settlement would likely have prohibited Google's plan to forbid installation of third party apps (excluding app stores from the definition of apps) unless those app developers had paid google a registration fee. The proposed settlement is here [1], the relevant portion is > 13.…

Did we read the same thing? I think Google here said there would be a $25 fee per developer (for those who can't fit in their limited distribution category). I suppose it's much better than a fee per paid install but it's not nothing.
Post reply on HN