Android developer verification: Early access starts • Hacker News Board

Re: Android developer verification: Early access starts

#291

Post by computerdork » Thu, Nov 13, 2025, 7:44 AM UTC

atoav wrote: post #270

ramshanker wrote: post #233

Ancedotal: I used to believe in this "freedom to install". Than my Father got scammed (~$1000) in the name of Electricity recharge. The APK was sent over WhatsApp. Now I am not so sure how to implement this freedom. At the bare minimum there has to be big red warnings. One thing which can immediately improve security is forbidding SMS read access forever. Just like Apple does. No App should be able to read SMS.

So your father: 1. Downloaded a weird file from a stranger 2. Went to the settings and about pyone sceeen 3. Tapped the thing 5 times to activate developer mode 4. Activated installing from third party sources despite the warning there 5. Installed the APK May I suggest the problem is not that this is possible, but a lack of education? If your father is the type that would jump into the bathtub with a toaster because…

eh, think this is a bit much to ask. Are we going to educate a majority of the baby boomers who just never got a feel for how technology works? Yeah, my Dad also just got scammed by a phishing scheme on his PC (and if a scammer had walked him through how to install an apk on his phone, he'd probably do that too).

In my humble opinion, in the design of a UI or any type of system, kind of have to go where the users take you to some degree. And Android, being an OS for consumer devices, should be geared toward the masses and the mistakes they'll make.

Re: Android developer verification: Early access starts

#292

Post by hasperdi » Thu, Nov 13, 2025, 7:44 AM UTC

andyjohnson0 wrote: post #281

sschueller wrote: post #220

They will just add a flag in the SafetyNet service to let other apps know if non "verified" apps have been installed. You will not be able to use any of your banking apps without first removing all of those... We need alternatives, this will not work and is a risk to freedom/democracy for all of us. Switzerland is implementing a digital ID[1]. It will be made available to the most common devices and is open source. H…

> They will just add a flag in the SafetyNet service to let other apps know if non "verified" apps have been installed. Sincere question: do you have any evidence for this? I don't see anything in the article that backs it up, and your asserion seems to be at odds with the description of a side load capability for "risk tolerant" users. What you describe would certainly break much of the usefulness of side loading fo…

It a projection of what they could do. ie. logical step

The whole SafetyNet and "secure chain" things are PITA, eg. ChatGPT app wouldn't work if the phone bootloader isn't signed by Google. Lots of banking app wouldn't work, HSBC banking app for instance wouldn't allow login if Android developer mode is enabled.

Re: Android developer verification: Early access starts

#293

Post by IshKebab » Thu, Nov 13, 2025, 7:45 AM UTC

notepad0x90 wrote: post #271

flakiness wrote: post #205

Earlier quoted context omitted.

It's not super clear from the post, but if I read it correctly there are two modifications suggested. - 1: Separate verification type for "student and hobbyist" - 2: "advanced flow" for "power users" that allows sideloading of unverified apps - I imagine this is some kind of scare-screen, but we'll see. What you describe as "worst of both worlds" is about point 1. I'm not sure point 2 is powerful enough to suppor thi…

malware are good at getting users to click past scare screens unfortunately. this isn't a solved problem, even with desktop browsers.

There are definitely things you could do to improve it though. E.g. you can't activate "I know what I'm doing" mode while on the phone or for 1 hour after a phone call. Someone else suggested a one-day cooldown.

Also for the specific scam they mentioned, why do apps even have permission to intercept all notifications?? Just fix that!

Re: Android developer verification: Early access starts

#294

Post by peterdn » Thu, Nov 13, 2025, 7:46 AM UTC

floppyd wrote: post #284

Biganon wrote: post #247

Earlier quoted context omitted.

> The APK was sent over WhatsApp. Why did your father enable installing APK packages from third party sources? That's a setting buried deep inside the developer settings, which themselves have to be activated with a very arcane manipulation

I believe this only works this way on some android forks, iirc you are talking about Samsung. Stock android would show a warning "do you want to install apk from this app?" and lead you to a settings page that enables apk installs from this particular app. No need to separately enable the ability to install apks in general. I always thought this is a very weird flow, it adds hoops yet accomplishes nothing because the…

This is also how it works on my Samsung Galaxy S21. There's no need to enable developer settings.

Re: Android developer verification: Early access starts

#295

Post by [deleted] » Thu, Nov 13, 2025, 7:51 AM UTC

xnx wrote: post #74

unsungNovelty wrote: post #70

Earlier quoted context omitted.

Its my device. Not google's. Imagine telling you which NPM/PIP packages you can install from your terminal. Also, its not SIDE loading. Its installing an app.

I agree, but I don't see why Google gets more critical attention than the iPhone or Xbox.

[deleted]

Re: Android developer verification: Early access starts

#296

Post by DavideNL » Thu, Nov 13, 2025, 7:51 AM UTC

geoffschmidt wrote: post #6

Aachen wrote: post #4

Edit: be sure to read geoffschmidt's reply below /edit The buried lede: > a dedicated account type for students and hobbyists. This will allow you to distribute your creations to a limited number of devices without going through the full verification So a natural limit on how big a hobby project can get. The example they give, where verification would require scammers to burn an identity to build another app instead…

But see also the next section ("empowering experienced users"): > We are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified

> We are building a new advanced flow that allows experienced users to accept the risks of installing software that isn't verified

Sure, they'll keep building it forever — this is just a delay tactic.

Re: Android developer verification: Early access starts

#297

Post by hasperdi » Thu, Nov 13, 2025, 7:52 AM UTC

magguzu wrote: post #139

rrix2 wrote: post #41

Earlier quoted context omitted.

it's probably just gonna be under the Developer Options "secret" menu

Which is totally fine IMO, it was weird to me that they weren't going with this approach when they first announced it. Macs blocked launching apps from unverified devs, but you can override in settings. I thought they could just do something along those lines.

It's not fine. Some apps particularly banking apps have developer mode detection and refuse to work if developer mode is enabled.

Re: Android developer verification: Early access starts

#298

Post by procaryote » Thu, Nov 13, 2025, 7:53 AM UTC

ashikns wrote: post #67

tomrod wrote: post #36

Earlier quoted context omitted.

I bought the hardware, therefore I have the right to modify and repair. Natural right, full stop. That right ends are your nose, as the saying goes.

Yeah then you have the choice to not buy the locked down hardware, you don't have a right to get open hardware FROM Google. Of course there are no good options for open hardware, but that is a related but separate problem.

Regulating this is the way to not let general computing die to fuel google and apple profits.

People should have the right to run whatever software they like on the computing hardware they own. They should have the right to repair it.

The alternative is that everything ends up like smart-tvs where the options are "buy spyware ridden crap" or "don't have a tv"

Re: Android developer verification: Early access starts

#299

Post by floppyd » Thu, Nov 13, 2025, 7:53 AM UTC

peterdn wrote: post #294

floppyd wrote: post #284

Earlier quoted context omitted.

I believe this only works this way on some android forks, iirc you are talking about Samsung. Stock android would show a warning "do you want to install apk from this app?" and lead you to a settings page that enables apk installs from this particular app. No need to separately enable the ability to install apks in general. I always thought this is a very weird flow, it adds hoops yet accomplishes nothing because the…

This is also how it works on my Samsung Galaxy S21. There's no need to enable developer settings.

I have definitely seen this "you need to go deep in the settings to enable 3rd party installs at all" flow before, but I don't remember which device it was. (Just saying that the commenter above is not just inventing something, I was surprised when I saw it as well)

Re: Android developer verification: Early access starts

#300

Post by travisgriggs » Thu, Nov 13, 2025, 7:54 AM UTC

svat wrote: post #217

thaumasiotes wrote: post #192

Earlier quoted context omitted.

> there cannot exist an easy way for a typical non-technical user to install “unverified apps” (whatever that means), because the governments of countries where such scams are widespread will hold Google responsible. What, the same way they hold Microsoft responsible for the fact that you can install whatever you want in Windows? Obviously, there can exist an easy way for a non-technical user to install unverified ap…

This is actually a good point, and something I've been wondering about too. What changed between the 90s and now, that Microsoft didn't get blamed for malware on Windows, but Google/Apple would be blamed now for malware on their devices? It seems that the environment today is different, in the sense that if (widespread) PCs only came into existence now, the PC makers would be considered responsible for harms therefro…

Windows 95 (and patronage) had become a shitshow. It’s easy to forget how much time us tech types were spending “fixing” uncle’s PC that somehow got malware on it. How we touted Linux as an escape from the hellscape of crapware.

It was into this void that the “everything seems new” iPhone stepped and ventured out in a different course. I’m neither speaking for or against apples normalization of an App Store as a primary source of updates, just recalling the way things were, and positing that Apple was trying a different approach that initially offered a computing platform that wasn’t the hellscape that MS platform was quickly becoming.