Android developer verification: Early access starts • Hacker News Board

Re: Android developer verification: Early access starts

#111

Post by Zak » Thu, Nov 13, 2025, 3:29 AM UTC

klabb3 wrote: post #102

themafia wrote: post #3

> Keeping users safe on Android is our top priority. I highly doubt this is your "top" priority. Or if it is then you're gotten there by completely ignoring Google account security. > intercepts the victim's notifications And who controls these notifications and forces application developers to use a specific service? > bad actors can spin up new harmful apps instantly. Like banking applications that use push or SMS…

> > intercepts the victim's notifications > And who controls these notifications and forces application developers to use a specific service? Am I alone in being alarmed by this? Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps? And they must instead rely on centralized control to disable those apps after the crime? So.. what’s the point of the s…

> Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps?

An app can read the content of notifications if the appropriate permissions are granted, which includes 2FA codes sent by SMS or email. That those are bad ways to provide 2FA codes is its own issue.

I want that permission to exist. I use KDE Connect to display notifications on my laptop, for example. Despite the name, it's not just for KDE or Linux - there are Windows and Mac versions too.

Re: Android developer verification: Early access starts

#112

Post by nunez » Thu, Nov 13, 2025, 3:30 AM UTC

Glad to see Google come to their senses on this. Disabling it entirely would have basically guaranteed an exodus of power users over to iOS. If your only choices are walled gardens, you might as well pick the easiest, prettiest one.

Re: Android developer verification: Early access starts

#113

Post by [deleted] » Thu, Nov 13, 2025, 3:31 AM UTC

thisislife2 wrote: post #88

svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

I don't buy this argument at all that this specific implementation is under pressure from the government - if the problem is indeed malware getting access to personal data, then the very obvious solution is to ensure that such personal data is not accessible by apps in the first place! Why should apps have access to a user's SMS / RCS? (Yeah, I know it makes onboarding / verification easy and all, if an app can acces…

[deleted]

Re: Android developer verification: Early access starts

#114

Post by cesarb » Thu, Nov 13, 2025, 3:31 AM UTC

edent wrote: post #103

LoganDark wrote: post #83

Earlier quoted context omitted.

It's not possible to provide a path for advanced users that a stupid person can't be coerced to use. Moreover, it's not possible to provide a path for advanced users that a stupid person won't use by accident, either. These are what drive many instances of completely missing paths for advanced users. It's not possible to stop coercion or accidents. It is literally impossible. Any company that doesn't want to take the…

Android could have, for example, a 24 hour "cooling off" period for sideloading approval. Much like some bootloader unlocking - make it subject to a delay. That immediately takes the pressure off people who are being told that their bank details are at immediate risk.

> Android could have, for example, a 24 hour "cooling off" period for sideloading approval.

And, to prevent the scammer from simply calling back once the 24 hours are gone, make it show a couple of warnings (at random times so they can't be predicted by the scammer) explaining the issue, with rejecting these warnings making the cooling off timer reset (so a new attempt to enable would need another full 24 hours).

Re: Android developer verification: Early access starts

#115

Post by [deleted] » Thu, Nov 13, 2025, 3:33 AM UTC

Zak wrote: post #101

svat wrote: post #65

Earlier quoted context omitted.

I can easily believe that Google's YouTube team would love to kill off such apps, if they can make a significant (say ≥1%) impact on revenue. (After all, being able to make money from views is an actual part of the YouTube product features that they promise to “creators”, which would be undermined if they made it too easy to circumvent.) But having seen how things work at large companies including Google, I find it l…

I would like a world where buying something means you get final say over how it operates even if you might do something dangerous/harmful/illegal.

[deleted]

Re: Android developer verification: Early access starts

#116

Post by gpm » Thu, Nov 13, 2025, 3:34 AM UTC

dgoldstein0 wrote: post #110

gpm wrote: post #14

8 days ago Google and Epic announced a proposed settlement and modification of a permanent injunction that Epic won, I believe this proposed settlement would likely have prohibited Google's plan to forbid installation of third party apps (excluding app stores from the definition of apps) unless those app developers had paid google a registration fee. The proposed settlement is here [1], the relevant portion is > 13.…

Did we read the same thing? I think Google here said there would be a $25 fee per developer (for those who can't fit in their limited distribution category). I suppose it's much better than a fee per paid install but it's not nothing.

See the "Empowering experienced users" section.

They announced the $25 "verification" plan awhile ago. The new part in this article is that they're going to have it remain possible to install software that didn't do that "verification".

> Based on this feedback and our ongoing conversations with the community, we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified.

Re: Android developer verification: Early access starts

#117

Post by bilekas » Thu, Nov 13, 2025, 3:34 AM UTC

Imagine you could do with your hardware what you wanted. Brave. Innovative. Revolutionary.

/Old man laughing at "cloud" that is my baremetal.

Re: Android developer verification: Early access starts

#118

Post by devsda » Thu, Nov 13, 2025, 3:36 AM UTC

They didn't say no changes. They are just saying we'll address the concerns of hobbyists and students.

Lets not celebrate prematurely and let us wait for more details on whats actually changing both technically and process wise. We should demand more clarity and should not wait to discover it after the implementation at which point it is hard and nearly impossible to push back against.

We don't want to be in a situation where they technically make it possible but make it practically impossible to install apps outside playstore.

Re: Android developer verification: Early access starts

#119

Post by colordrops » Thu, Nov 13, 2025, 3:36 AM UTC

tomrod wrote: post #36

svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

I bought the hardware, therefore I have the right to modify and repair. Natural right, full stop. That right ends are your nose, as the saying goes.

I don't think it's illegal to do whatever you want with your phone. That doesn't mean google legally is required to make it easy or even possible. That being said I ethically they should allow it, and considering their near monopoly status they should be forced to keep things open. In fact there should be right to repair laws too.

Re: Android developer verification: Early access starts

#120

Post by sowbug » Thu, Nov 13, 2025, 3:36 AM UTC

BrenBarn wrote: post #23

The key question for me is whether this "advanced flow" will allow the practical use of entirely separate app stores (like F-Droid) or if they're going to throw up tons of barriers for every individual app install.

If I were designing the advanced flow, I'd require the decision to be made at phone setup time. Changing your mind later requires a factory reset.

Real sideloaders (F-Droid users, etc.) know at setup time that that's how they'll be using their phone, so it works for them. But ordinary users who are targets for sideloading malware will become a lot less attractive if attackers must convince them to wipe their phone to complete the coercive instructions.

Aliexpress has a similar approach to protect their accounts from takeovers. If you change or forget your password, all your saved payment methods are erased. This makes the account less valuable to an attacker, at the cost of a little pain to authentic account holders.