Android developer verification: Early access starts • Hacker News Board

Re: Android developer verification: Early access starts

#261

Post by archon810 » Thu, Nov 13, 2025, 7:01 AM UTC

sowbug wrote: post #120

BrenBarn wrote: post #23

The key question for me is whether this "advanced flow" will allow the practical use of entirely separate app stores (like F-Droid) or if they're going to throw up tons of barriers for every individual app install.

If I were designing the advanced flow, I'd require the decision to be made at phone setup time. Changing your mind later requires a factory reset. Real sideloaders (F-Droid users, etc.) know at setup time that that's how they'll be using their phone, so it works for them. But ordinary users who are targets for sideloading malware will become a lot less attractive if attackers must convince them to wipe their phone to…

Forgive my bluntness, but I hope you are never allowed on the Android team or near any significant UX decisions on any devices or apps I use or will use.

Re: Android developer verification: Early access starts

#262

Post by monkpit » Thu, Nov 13, 2025, 7:04 AM UTC

creichenbach wrote: post #259

Llamamoe wrote: post #245

Earlier quoted context omitted.

Seriously though, can anyone tell me why the fuck banking apps try so hard to find any possible excuse to not run on customised devices? I just can't see any good reason for it but my banking app has invested more work into detecting any possible hint of rooting than into its UX. It's absurd.

Banks have stupid rules probably made by people who don't understand the matter. A relative recently got victim to phishing and gave away some of his banking details (fake e-banking login screen on a website). After locking the account, the bank said it would only unlock it after the phone got wiped, which obviously doesn't add anything in this situation. Another pet peeve is that they prevent screenshots simply beca…

> Banks have stupid rules probably made by people who don't understand the matter.

Their insurance policies, if I had to guess.

Re: Android developer verification: Early access starts

#263

Post by groestl » Thu, Nov 13, 2025, 7:04 AM UTC

Elfener wrote: post #258

Llamamoe wrote: post #245

Earlier quoted context omitted.

Seriously though, can anyone tell me why the fuck banking apps try so hard to find any possible excuse to not run on customised devices? I just can't see any good reason for it but my banking app has invested more work into detecting any possible hint of rooting than into its UX. It's absurd.

It may not be banks themselves doing this. For example, my bank here in Hungary, Erste Bank has announced that the central bank requested that they stop allowing their android app to run on "modified" devices. They even have a workaround: switch to SMS-based 2FA and use their website (which works well on any screen and has all the features of the app except 2FA)

> the central bank requested

That's the answer, it's regulatory bodies causing this.

Re: Android developer verification: Early access starts

#264

Post by rbits » Thu, Nov 13, 2025, 7:04 AM UTC

xg15 wrote: post #99

So there was the very concrete problem that F-Droid could not continue to function with the verification requirements, because they rebuild every app and so would have to know every key. Do the changes here do anything for F-Droid?

What this probably means: to use F-Droid on your phone, you will have to first go through the new unverified app flow

Re: Android developer verification: Early access starts

#265

Post by rbits » Thu, Nov 13, 2025, 7:08 AM UTC

DeathArrow wrote: post #236

I can access any website or webapp without verification. I can install any app on my PC without verification. I assume the results of my actions and I accept that if something bad is going to happen, it's my fault. I am fine with that. I want the same kind of freedom on my phone, a device I own and I payed for with my own money. I am not smarter when using the PC and dumber when using the phone. I want to be able to…

Don't know if I misunderstood your comment, but that's what the article is saying. You will be able to opt out of unverified app blocking.

Re: Android developer verification: Early access starts

#266

Post by izacus » Thu, Nov 13, 2025, 7:08 AM UTC

advisedwang wrote: post #172

xyzzy_plugh wrote: post #127

> we are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified. We are designing this flow specifically to resist coercion, ensuring that users aren't tricked into bypassing these safety checks while under pressure from a scammer. It will also include clear warnings to ensure users fully understand the risks involved, but ultimately, it puts the choi…

Does this allow unsigned binaries like today? Or is this now requiring you have a binary signed by a android developer account but just one without full identity verification.

All Android devices require signed binaries and have done so since 1.0.

Re: Android developer verification: Early access starts

#267

Post by moi2388 » Thu, Nov 13, 2025, 7:09 AM UTC

Good job everybody, just don’t start complaining when your family members installed malware, their banking and health information is leaked, and you have to fix this for them.

Re: Android developer verification: Early access starts

#268

Post by notepad0x90 » Thu, Nov 13, 2025, 7:10 AM UTC

lern_too_spel wrote: post #187

notepad0x90 wrote: post #145

This is the worst of both worlds, you can spread your malware as a sideloaded apk just fine, but when it's so big that you're probably burned anyways, then you need to verify your account. I think a better compromise would have been for google to require developer verification, but also allow third party appstores like f-droid that don't require verification but still are required to "sign" the apks, instead of users…

> Google can then require highlighting things like number of downloads and developer reputation by 3rd party appstores F-droid doesn't want to track number of installs because that is an invasion of privacy. > require developer verification, but also allow third party appstores like f-droid that don't require verification Now you've moved the problem from Google gatekeeping apps to Google gatekeeping app stores. We d…

Then i guess you can't publish apps? One of those issues where i should be "writing to my congressman" or whatever I guess. the problem is real and people like you are being obtuse, unwilling to find a solution or a compromise. Something as simple as number of installs is an invasion of privacy? how? it's a number, you increment a counter when someone hits download, that's it.

Yeah, if google gets to have rules over what happens by apps that have their seal of approval. that's how seals of approvals work. you're not entitled to these things. you don't have the right to publish to the android platform, if Google, wary of anti-trust suits allows a 3rd party app store, it can institute reasonable requirements.

If an appstore is willingly hosting malware, should Google still provide their seal of approval? That was supposed to be rhetoric, but I wouldn't be surprised if you told me that they should.

This is willful ignorance, I only hope you educate yourself on the harms caused by malware and malicious actors and consider taking a practical approach to finding solutions instead of dying on every single hill.

Re: Android developer verification: Early access starts

#269

Post by realusername » Thu, Nov 13, 2025, 7:11 AM UTC

klabb3 wrote: post #102

themafia wrote: post #3

> Keeping users safe on Android is our top priority. I highly doubt this is your "top" priority. Or if it is then you're gotten there by completely ignoring Google account security. > intercepts the victim's notifications And who controls these notifications and forces application developers to use a specific service? > bad actors can spin up new harmful apps instantly. Like banking applications that use push or SMS…

> > intercepts the victim's notifications > And who controls these notifications and forces application developers to use a specific service? Am I alone in being alarmed by this? Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps? And they must instead rely on centralized control to disable those apps after the crime? So.. what’s the point of the s…

> Are they admitting that their app sandboxing is so weak that a malicious app can exfil data from other unaffiliated apps?

It's not news, both iOS and Android sandboxing are Swiss cheese compared to a browser.

People should only install apps from trusted publishers (and not everything from the store is trusted as the store just gors very basic checks)

Re: Android developer verification: Early access starts

#270

Post by atoav » Thu, Nov 13, 2025, 7:11 AM UTC

ramshanker wrote: post #233

Ancedotal: I used to believe in this "freedom to install". Than my Father got scammed (~$1000) in the name of Electricity recharge. The APK was sent over WhatsApp. Now I am not so sure how to implement this freedom. At the bare minimum there has to be big red warnings. One thing which can immediately improve security is forbidding SMS read access forever. Just like Apple does. No App should be able to read SMS.

So your father: 1. Downloaded a weird file from a stranger

2. Went to the settings and about pyone sceeen

3. Tapped the thing 5 times to activate developer mode

4. Activated installing from third party sources despite the warning there

5. Installed the APK

May I suggest the problem is not that this is possible, but a lack of education? If your father is the type that would jump into the bathtub with a toaster because someone on whatsapp told them to do so, I am afraid it is not the existence of toasters that is the issue.