Android developer verification: Early access starts • Hacker News Board

Re: Android developer verification: Early access starts

#251

Post by p0w3n3d » Thu, Nov 13, 2025, 6:53 AM UTC

This is the last moment we can use to move out of this platform. We've already given basically all the control on our lives to two companies. They will decide one day that government will know our each move, our WiFi password, number of appliances, our body temperature and chemical compounds of our bodily fluids - every sensor that is connected to the system. 1984 all over again but this time IRL

This is old rule: you don't need to take over control of all the people, you just need to take over those two-three suppliers that are covering all the people. If for example new politician Tronald Dump will take seat in 2035 in USA and they will try to push their agenda to other countries, they will take over the LLM, phone and OS providers, namely OpenAI, MS, Apple, Google. That's all to control to have the souls ruled all over the world. If something must vanish, will vanish. Like in the Ministry of Truth

Re: Android developer verification: Early access starts

#252

Post by rbits » Thu, Nov 13, 2025, 6:54 AM UTC

lokar wrote: post #142

xyzzy_plugh wrote: post #127

> we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choi…

What if it imposed a longish (one time) cooldown period? A day?

1 day is not longish. That would greatly harm apps like F-Droid. You'd have to go through it every time you want to update your apps.

Re: Android developer verification: Early access starts

#253

Post by sschueller » Thu, Nov 13, 2025, 6:54 AM UTC

Llamamoe wrote: post #245

sschueller wrote: post #220

They will just add a flag in the SafetyNet service to let other apps know if non "verified" apps have been installed. You will not be able to use any of your banking apps without first removing all of those... We need alternatives, this will not work and is a risk to freedom/democracy for all of us. Switzerland is implementing a digital ID[1]. It will be made available to the most common devices and is open source. H…

Seriously though, can anyone tell me why the fuck banking apps try so hard to find any possible excuse to not run on customised devices? I just can't see any good reason for it but my banking app has invested more work into detecting any possible hint of rooting than into its UX. It's absurd.

Insurance, they don't want to be on the hook if you get robbed.

Re: Android developer verification: Early access starts

#254

Post by archon810 » Thu, Nov 13, 2025, 6:56 AM UTC

Llamamoe wrote: post #245

sschueller wrote: post #220

They will just add a flag in the SafetyNet service to let other apps know if non "verified" apps have been installed. You will not be able to use any of your banking apps without first removing all of those... We need alternatives, this will not work and is a risk to freedom/democracy for all of us. Switzerland is implementing a digital ID[1]. It will be made available to the most common devices and is open source. H…

Seriously though, can anyone tell me why the fuck banking apps try so hard to find any possible excuse to not run on customised devices? I just can't see any good reason for it but my banking app has invested more work into detecting any possible hint of rooting than into its UX. It's absurd.

Probably because it makes it easier to observe and/or intercept API calls and other data exchange between the client and the server. It's trivial to disable things like SSL cert pinning, etc. on rooted devices.

Re: Android developer verification: Early access starts

#255

Post by ptrl600 » Thu, Nov 13, 2025, 6:56 AM UTC

If it doesn't require a Google account and just means jumping through a bunch of hoops the first time, maybe requiring a USB cable, OK. If it does require a Google account, or won't let you give permission to F-Droid to install stuff, I call foul.

Re: Android developer verification: Early access starts

#256

Post by rbits » Thu, Nov 13, 2025, 6:56 AM UTC

gowthamgts12 wrote: post #156

erohead wrote: post #2

Sounds like they're rolling back the mandatory verification flow: Based on this feedback and our ongoing conversations with the community, we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure…

> Sounds like they're rolling back the mandatory verification flow absolutely no. this is for the user side. but if you're a developer who is planning to publish the app in alternative play store/from your website, you have to do verification flow. please read the full text.

But it's not mandatory anymore because people can install it without it being verified.

Re: Android developer verification: Early access starts

#257

Post by wmf » Thu, Nov 13, 2025, 6:57 AM UTC

svat wrote: post #217

thaumasiotes wrote: post #192

Earlier quoted context omitted.

> there cannot exist an easy way for a typical non-technical user to install “unverified apps” (whatever that means), because the governments of countries where such scams are widespread will hold Google responsible. What, the same way they hold Microsoft responsible for the fact that you can install whatever you want in Windows? Obviously, there can exist an easy way for a non-technical user to install unverified ap…

This is actually a good point, and something I've been wondering about too. What changed between the 90s and now, that Microsoft didn't get blamed for malware on Windows, but Google/Apple would be blamed now for malware on their devices? It seems that the environment today is different, in the sense that if (widespread) PCs only came into existence now, the PC makers would be considered responsible for harms therefro…

I always blamed Microsoft for Windows insecurity. But seriously, Windows did not have any vetting process for apps and apps didn't really have access to money. Google's problem is that they claim Android is a secure way to do banking but it isn't.

Re: Android developer verification: Early access starts

#258

Post by Elfener » Thu, Nov 13, 2025, 6:58 AM UTC

Llamamoe wrote: post #245

sschueller wrote: post #220

They will just add a flag in the SafetyNet service to let other apps know if non "verified" apps have been installed. You will not be able to use any of your banking apps without first removing all of those... We need alternatives, this will not work and is a risk to freedom/democracy for all of us. Switzerland is implementing a digital ID[1]. It will be made available to the most common devices and is open source. H…

Seriously though, can anyone tell me why the fuck banking apps try so hard to find any possible excuse to not run on customised devices? I just can't see any good reason for it but my banking app has invested more work into detecting any possible hint of rooting than into its UX. It's absurd.

It may not be banks themselves doing this.

For example, my bank here in Hungary, Erste Bank has announced that the central bank requested that they stop allowing their android app to run on "modified" devices.

They even have a workaround: switch to SMS-based 2FA and use their website (which works well on any screen and has all the features of the app except 2FA)

Re: Android developer verification: Early access starts

#259

Post by creichenbach » Thu, Nov 13, 2025, 6:59 AM UTC

Llamamoe wrote: post #245

sschueller wrote: post #220

They will just add a flag in the SafetyNet service to let other apps know if non "verified" apps have been installed. You will not be able to use any of your banking apps without first removing all of those... We need alternatives, this will not work and is a risk to freedom/democracy for all of us. Switzerland is implementing a digital ID[1]. It will be made available to the most common devices and is open source. H…

Seriously though, can anyone tell me why the fuck banking apps try so hard to find any possible excuse to not run on customised devices? I just can't see any good reason for it but my banking app has invested more work into detecting any possible hint of rooting than into its UX. It's absurd.

Banks have stupid rules probably made by people who don't understand the matter. A relative recently got victim to phishing and gave away some of his banking details (fake e-banking login screen on a website). After locking the account, the bank said it would only unlock it after the phone got wiped, which obviously doesn't add anything in this situation.

Another pet peeve is that they prevent screenshots simply because they can, and it feels safer. I know, 3rd-party apps which can do screenshots etc., but this is fighting the threat the wrong way. And yes, it's partially the fault of the platform, which could just allow user-initiated screenshots. Or at least make it configurable.

Re: Android developer verification: Early access starts

#260

Post by 11mariom » Thu, Nov 13, 2025, 6:59 AM UTC

Security by obscurity. That's my device, that's my decision to install whatever I want.

I see here and there some comments about someone was scammed, etc… Lack of knowledge of users is not a good reason. They still will get scammed, in a different way, but outcome will be the same.

On PC one can install whatever want - and nobody is blaming OS for it.