Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

161–170 of 694 posts

Re: Android developer verification: Early access starts

#161

Post by metadat »

Are there any entities on earth with resources to compete with a complicit global duopoly?

If Android is open source, why can't/won't a community fork it? Graphene OS exists but many folks claim Netflix and banking apps do not work with it (despite allowing logins from any common desktop browser)?

If all widely-accepted phone operating systems are de-facto proprietary, what does this say about the current phase of society?

What choice do non-billionaire/millionaire humans have for living in a single-planet society where technology is so highly integrated (and the inherent non-consensual compromises)?

What If the little people are going to get squeezed even more?

Troubling questions.

Re: Android developer verification: Early access starts

#162

Post by Aeolun »

Aurornis wrote: post #45
Lammy wrote: post #17

Earlier quoted context omitted.

Google have their own reasons too. They would love to kill off YouTube ReVanced and other haxx0red clients that give features for free which Google would rather sell you on subscription. Just look at everything they've done to break yt-dlp over and over again. In fact their newest countermeasure is a frontpage story right beside this one: https://news.ycombinator.com/item?id=45898407

You’re still proving the point above, which is ignoring the fact that the restriction is specifically targeted at a small number of countries. Google is also rolling out processes for advanced users to install apps. It’s all in the linked post (which apparently isn’t being read by the people injecting their own assumptions) Google is not rolling this out to protect against YouTube ReVanced but only in a small number…

A small number of countries now. The rest of the world in 2027 and beyond.

Re: Android developer verification: Early access starts

#163

Post by Ms-J »

uneven9434 wrote: post #126

There are many real-world sideloading abuse cases in China. Attackers often trick victims with plausible stories—e.g., claiming a flight is delayed—and ask them to sideload an app (a remote‑meeting or remote‑control tool) to share their screen. Once installed, the attacker can view the victim’s screen and intercept SMS 2FA codes for online banking or other sensitive accounts. Other schemes include impersonating sex w…

These unfortunately gullible people would be tricked in many different other ways throughout their daily lives even if it wasn't for the ability to install something on a device that you paid for and outright own.

We don't cater the most stupid in society.

Re: Android developer verification: Early access starts

#164

Post by Gigablah »

metadat wrote: post #161

Are there any entities on earth with resources to compete with a complicit global duopoly? If Android is open source, why can't/won't a community fork it? Graphene OS exists but many folks claim Netflix and banking apps do not work with it (despite allowing logins from any common desktop browser)? If all widely-accepted phone operating systems are de-facto proprietary, what does this say about the current phase of so…

Well, would the community be willing to respond to AI-submitted CVEs without funding?

Re: Android developer verification: Early access starts

#165

Post by g-b-r »

sowbug wrote: post #120
BrenBarn wrote: post #23

The key question for me is whether this "advanced flow" will allow the practical use of entirely separate app stores (like F-Droid) or if they're going to throw up tons of barriers for every individual app install.

If I were designing the advanced flow, I'd require the decision to be made at phone setup time. Changing your mind later requires a factory reset. Real sideloaders (F-Droid users, etc.) know at setup time that that's how they'll be using their phone, so it works for them. But ordinary users who are targets for sideloading malware will become a lot less attractive if attackers must convince them to wipe their phone to…

Great, at phone setup when many people don't know anything about the implications of the choice.

And factory reset when it's impossible to backup and restore everything, or anything at all without a Google account

Re: Android developer verification: Early access starts

#166

Post by echelon »

ryandrake wrote: post #10
Aachen wrote: post #8

Earlier quoted context omitted.

Oh! I thought I had found the crucial piece finally after ~500 words, but there's indeed better news in the section after that! Thanks, I can go sleep with a more optimistic feeling now :) Also this will kill any impetus that was growing on the Linux phone development side, for better or worse. We get to live in this ecosystem a while longer, let's see if people keep damocles' sword in mind and we might see more effo…

Let's take the "W". This is pretty good news!

This is not a win. This is having independent distribution shut down and controlled.

We no longer own our devices.

We're in a worse state than we were in before. Google is becoming a dictator like Apple.

Re: Android developer verification: Early access starts

#167

Post by opan »

metadat wrote: post #161

Are there any entities on earth with resources to compete with a complicit global duopoly? If Android is open source, why can't/won't a community fork it? Graphene OS exists but many folks claim Netflix and banking apps do not work with it (despite allowing logins from any common desktop browser)? If all widely-accepted phone operating systems are de-facto proprietary, what does this say about the current phase of so…

LineageOS is based on AOSP and works well. I don't understand the banking app thing either. I suspect it's a regional issue. I can log in to my credit union account via any browser, and if something needs MFA it should be able to use TOTP which works on anything.

Android in practice is full of proprietary blobs, stuck on old kernel versions, and the hardware is barely supported. Lots of downstream crap from the vendors not playing nice. Most devices running Android are instantly doomed to be e-waste. You can look through devices postmarketOS supports, and anything without mainline kernel support and most stuff working is basically e-waste unless someone puts in a lot of work for that particular device. It's a little bit like how modern GPUs don't work without blobs in the kernel anymore and you have to go back to Haswell era or older for things to work with all free software, but the state of smartphones is a few steps worse than that due to their locked down nature.

Pretty much any OnePlus device (other than ones still too new) seems to be a good bet for decent software support (both LineageOS and pmOS). Though annoyingly stuff like the 3G shutdown makes a lot of the earlier models unusable as actual phones these days. At least they can still be computers. Not quite e-waste.

Re: Android developer verification: Early access starts

#168

Post by lern_too_spel »

thisislife2 wrote: post #88
svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

I don't buy this argument at all that this specific implementation is under pressure from the government - if the problem is indeed malware getting access to personal data, then the very obvious solution is to ensure that such personal data is not accessible by apps in the first place! Why should apps have access to a user's SMS / RCS? (Yeah, I know it makes onboarding / verification easy and all, if an app can acces…

> Note also that while they are not completely removing sideloading (for now) they are introducing further restrictions on it, including gate-keeping by them.

This blog post is specifically saying there will be a way to bypass the gatekeeping on Google-blessed Android builds, just as we wanted.

> But that kind of privacy based security model is anathema to Google because its whole business model is based on violating its users' privacy.

Despite this, they sell some of the most privacy-capable phones available, with the Pixels having unlockable bootloaders. Even without unlocking the bootloader to install something like GrapheneOS, they support better privacy than the other mass market mobile phones by Samsung and Apple, which both admittedly set a low bar.

Re: Android developer verification: Early access starts

#169

Post by advisedwang »

geoffschmidt wrote: post #6
Aachen wrote: post #4

Edit: be sure to read geoffschmidt's reply below /edit The buried lede: > a dedicated account type for students and hobbyists. This will allow you to distribute your creations to a limited number of devices without going through the full verification So a natural limit on how big a hobby project can get. The example they give, where verification would require scammers to burn an identity to build another app instead…

But see also the next section ("empowering experienced users"): > We are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified

That doesn't say that you can just build an APK and distribute it. I suspect this path _still_ requires you to create a developer console account and distribute binaries signed by it... just that that developer account doesn't have to have completed identity verification.

Re: Android developer verification: Early access starts

#170

Post by miki123211 »

thisislife2 wrote: post #88
svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

I don't buy this argument at all that this specific implementation is under pressure from the government - if the problem is indeed malware getting access to personal data, then the very obvious solution is to ensure that such personal data is not accessible by apps in the first place! Why should apps have access to a user's SMS / RCS? (Yeah, I know it makes onboarding / verification easy and all, if an app can acces…

> if the problem is indeed malware getting access to personal data, then the very obvious solution is to ensure that such personal data is not accessible by apps

Then you'd have the other "screaming minority" on HN show up, the "antitrust all the things" folks.

Post reply on HN