Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

121–130 of 694 posts

Re: Android developer verification: Early access starts

#121

Post by ashleyn »

Lammy wrote: post #17
svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

Google have their own reasons too. They would love to kill off YouTube ReVanced and other haxx0red clients that give features for free which Google would rather sell you on subscription. Just look at everything they've done to break yt-dlp over and over again. In fact their newest countermeasure is a frontpage story right beside this one: https://news.ycombinator.com/item?id=45898407

yt-dlp's days are fairly numbered as Google has a trump card they can eventually deploy: all content is gated behind DRM. IIRC the only reason YouTube content is not yet served exclusively through DRM is to maintain compatibility with older hardware like smart TVs.

Re: Android developer verification: Early access starts

#123

Post by gpm »

hekkle wrote: post #104
BrenBarn wrote: post #24

Earlier quoted context omitted.

Their top priority is making money.

BINGO! Google doesn't care at all about user security. - Just yesterday there was a story on here about how Google found esoteric bugs in FFMPEG, and told volunteers to fix it. - Another classic example, about how Google doesn't give a stuff about their user's security is the scam ads they allow on youtube. Google knows these are scams, but don't care because they there isn't regulation requiring oversight.

> Just yesterday there was a story on here about how Google found [a security vulnerability that anyone running `ffmpeg -i ...` was vulnerable to] in FFMPEG, and told [the world about it so that everyone could take appropriate action before hackers found the same thing and exploited it, having first told the ffmpeg developers about it in case they wanted to fix it before it was announced publicly]

Fixed that for you. Google's public service was both entirely appropriate and highly appreciated.

Re: Android developer verification: Early access starts

#124

Post by thisislife2 »

cesarb wrote: post #108
thisislife2 wrote: post #88

Earlier quoted context omitted.

I don't buy this argument at all that this specific implementation is under pressure from the government - if the problem is indeed malware getting access to personal data, then the very obvious solution is to ensure that such personal data is not accessible by apps in the first place! Why should apps have access to a user's SMS / RCS? (Yeah, I know it makes onboarding / verification easy and all, if an app can acces…

> Why should apps have access to a user's SMS / RCS? It could be an alternative SMS app like TextSecure. One of the best features of Android is that even built-in default applications like the keyboard, browser, launcher, etc can be replaced by alternative implementations. It could also be a SMS backup application (which can also be used to transfer the whole SMS history to a new phone). Or it could be something like…

That's all indeed valid.

> One of the best features of Android is that even built-in default applications like the keyboard, browser, launcher, etc can be replaced by alternative implementations.

When sideloading is barred all that can easily change. If you are forced to install everything from the Google Play Store, Google can easily bar such things, again in the name of "security" - alternate keyboards can steal your password, alternate browsers can have adware / malware, alternate launcher can do many naughty things etc. etc.

And note that if indeed giving apps access to SMS / RCS data is really such a desirable feature, Google could have introduced gate-keeping on that to make it more secure, rather than gate-keeping sideloading. For example, their current proposal says that they will allow sideloading with special Google Accounts. Instead of that, why not make it so that an app can access SMS / RCS only when that option is allowed when you have a special Google Account?

The point is that they want to avoid adding any barriers where a user's private data can't be easily accessed.

Re: Android developer verification: Early access starts

#125

Post by hattmall »

edent wrote: post #103
LoganDark wrote: post #83

Earlier quoted context omitted.

It's not possible to provide a path for advanced users that a stupid person can't be coerced to use. Moreover, it's not possible to provide a path for advanced users that a stupid person won't use by accident, either. These are what drive many instances of completely missing paths for advanced users. It's not possible to stop coercion or accidents. It is literally impossible. Any company that doesn't want to take the…

Android could have, for example, a 24 hour "cooling off" period for sideloading approval. Much like some bootloader unlocking - make it subject to a delay. That immediately takes the pressure off people who are being told that their bank details are at immediate risk.

The people gullible enough to fall for a scam like that are also gullible enough to follow more instructions 24 hours later. I think if you could force a call to the phone and have an agent or even AI that talks to user and makes sure no scam is involved then gives an unlock code based on deviceID or something. But that would cost money and scammers would work around it anyway.

Re: Android developer verification: Early access starts

#126

Post by uneven9434 »

There are many real-world sideloading abuse cases in China. Attackers often trick victims with plausible stories—e.g., claiming a flight is delayed—and ask them to sideload an app (a remote‑meeting or remote‑control tool) to share their screen. Once installed, the attacker can view the victim’s screen and intercept SMS 2FA codes for online banking or other sensitive accounts.

Other schemes include impersonating sex workers to lure victims into nude video chats, then persuading them to install an app that harvests private content and contacts for blackmail.

Re: Android developer verification: Early access starts

#127

Post by xyzzy_plugh »

> we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choice in their hands.

As long as this is a one-time flow: Good, great, yes, I'll gladly scroll through as many prompts as you want to enable sideloading. I understand the risks!

But I fear this will be no better than Apple's flow for installing unsigned binaries in macOS.

Please do better.

Re: Android developer verification: Early access starts

#128

Post by pabs3 »

> When the user logs into their real banking app, the malware captures their two-factor authentication codes

That seems like a severe security bug in Android APIs or sandboxing or something else.

> bad actors can spin up new harmful apps instantly

Why are harmful apps possible at all?

Re: Android developer verification: Early access starts

#129

Post by Ms-J »

Google still hasn't changed anything but took the opportunity to again insult their customers within the first headline, titled "Why verification is important".

Google goes on to say how taking away one of your last remaining rights is good for you, if you like it or not.

It is clear to everyone why Google is partnering with governments around the world to remove our rights to installing apps. Laws are not on your side and must be reevaluated on an individual level to move forward. You decide your own terms, you have the power.

Only we can stop this together.

Re: Android developer verification: Early access starts

#130

Post by xyzzy_plugh »

userbinator wrote: post #93
gdulli wrote: post #37

Earlier quoted context omitted.

Developers of these apps would have little motivation if the maximum audience size was cut down to the very few who would use adb. The ecosystem would die.

Or someone comes up with an easy adb wrapper and now it becomes the go-to way to install apps.

Shizuku[0][1] already exists, it would certainly suck but it wouldn't be the end of the world.

Of course I would be much happier if I didn't need to use Shizuku in the first place.

[0]: https://play.google.com/store/apps/details?id=moe.shizuku.pr...

[1]: https://shizuku.rikka.app/

Post reply on HN