Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Android developer verification: Early access starts

android-developers.googleblog.com

Post reply on HN
Print view View original

451–460 of 694 posts

Re: Android developer verification: Early access starts

#451

Post by vladms »

consp wrote: post #319
zarzavat wrote: post #316

Earlier quoted context omitted.

If you don't look both ways when you cross the road, then you may get hit by a car. The solution is to pay attention. It's acceptable to build a system where human error can lead to catastrophic consequences, even death. Every time you go outside you encounter many of these systems. Not everything in life can be made 100% safe, but that's no reason to stop living.

> The solution is to pay attention. Swindlers work by that is a story as old as time. Even snakeoil salesmen were good at distracting people from obvious signs of false promises and warnings. People often overestimate their own capabilities greatly, same as there are no bad drivers on the road when you ask people about themselves.

I'm afraid the solution is to learn from mistakes. Which can be painful, takes effort, and at which some people will fail.

Society must be aware we are balancing "protection" and "responsibility". If you want some freedom you must have some responsibility.

I do not mind offering to some people more "protection" if it is clear they give up some "freedom". Some might accept the risks, some will not.

Re: Android developer verification: Early access starts

#452

Post by thw_9a83c »

0xDEAFBEAD wrote: post #431
thw_9a83c wrote: post #386

Earlier quoted context omitted.

> "Never enable software installation if someone asks you..." Imagine a situation in which a frightened, stressed user sees such a message on their screen. Meanwhile, a very convincing fake police officer or bank representative is telling them over the phone that they must ignore this message due to specific dangerous emergency situation to save the money in their bank account. Would the user realize at that moment t…

What if there is a 12-hour delay to unlock "power user mode", and during that entire 12-hour unlock period, the phone keeps displaying various scam education information to help even an unsophisticated user figure out what's going on? Surely Google can devote a few full-time employees to keeping such educational materials up to date, so they ideally contain detailed descriptions of the most common scams a user is goi…

This would help for sure. Ideally, the phone should stay in "expert mode" for a limited time only, like 1 hour.

However, there is still a danger that scammers will call after 12 hours, and they will be more convincing than educational material (or the user may not have read it).

Re: Android developer verification: Early access starts

#454

Post by 0xDEAFBEAD »

sharperguy wrote: post #439
svat wrote: post #7

From the very first announcement of this, Google has hinted that they were doing this under pressure from the governments in a few countries. (I don't remember the URL of the first announcement, but https://android-developers.googleblog.com/2025/08/elevating-... is from 2025-August-25 and mentions “These requirements go into effect in Brazil, Indonesia, Singapore, and Thailand”.) The “Why verification is important” s…

Considering phone scammers often convince their victims to: - install remote desktop software - run commands in the windows terminal - withdraw cash from the bank - lie to the bank teller about their purpose - insert their cash into a bitcoin ATM at a gas station - ignore warnings about scams which appear on the screen of the ATM - insert the scammers bitcoin address into the machine It isn't a stretch to imagine the…

It seems to me if you raise the difficulty enough, and lower the success rate enough, at some point a given scam stops being economical. https://news.ycombinator.com/item?id=45913529

Re: Android developer verification: Early access starts

#456

Post by cesarb »

sharperguy wrote: post #437
OrangeMusic wrote: post #433

Earlier quoted context omitted.

Google wants 0 friction for apps to display ads.

What incentive is there for OEMs to not add this option though? Does Google refuse to veriy their firmware if they offer this feature?

> Does Google refuse to veriy their firmware if they offer this feature?

If a manufacturer doesn't follow the Android CDD (https://source.android.com/docs/compatibility/cdd), Google will not allow them to bundle Google's closed source apps (which include the Google Play store). It was originally a measure to prevent fragmentation. I don't know whether this particular detail (not exposing this particular permission) is part of the CDD.

Re: Android developer verification: Early access starts

#457

Post by cesarb »

bmacho wrote: post #400
lopis wrote: post #391

Earlier quoted context omitted.

If an app updates to require new permissions, or to suddenly require network access, or the owner contact details change, Google Play should ideally stop that during the update review process and let the users know. But that wouldn't be good for business.

Indeed, an update can't be more malicious than the permissions allow it to be. You have a calculator app with limited permissions, it is "safe" to set to allow the developer to update it. No danger in that. But I don't think it is enough, or it is the right model. In other cases, when the app has dangerous permissions already, auto-update should be a no-go.

> Indeed, an update can't be more malicious than the permissions allow it to be.

...in the absence of sandbox escape bugs.

Re: Android developer verification: Early access starts

#458

Post by tcfhgj »

GuB-42 wrote: post #428
leoedin wrote: post #364

Earlier quoted context omitted.

I don't really see how you can both allow developers to update their apps automatically (which is widely promoted as being good security practice) and also defend against good developers turning bad. How does Google know if someone has sold off their app? In most cases, F-Droid couldn't know either. A developer transferring their accounts and private keys to someone else is not easily detected.

The point here is that app developers have to identify themselves. Google has no intention to verify the content of sideloaded apps, just that it is signed by a real person, for accountability. They don't know if the person who signed the app is the developer, but should the app happen to be a scam and there is a police investigation, that is the person who will have to answer questions, like "who did you transfer th…

> Google has no intention to verify the content of sideloaded apps, just that it is signed by a real person, for accountability.

for now

Re: Android developer verification: Early access starts

#459

Post by babuskov »

_cenw wrote: post #394
lopis wrote: post #391

Earlier quoted context omitted.

If an app updates to require new permissions, or to suddenly require network access, or the owner contact details change, Google Play should ideally stop that during the update review process and let the users know. But that wouldn't be good for business.

This is a huge problem in the Chrome Web Store and Google is doing very little about it. If you ever made an extension that is even just a little popular, expect to get acquisition offers by people who want to add malicious features somewhere between click fraud, residential IP services or even password stealers.

Same for Play Store. I have 2 games and I keep getting offers all the time. The last one offered $2000 for the developer account or a $100 monthly rent.

From their email pitch:

> We’re now offering from $500 to $2000 for a one-time purchase of a developer account that includes apps, or a rental deal starting from $100.

> No hidden conditions — quick process, secure agreement, and immediate payment upon verification.

> We’re simply looking for reliable accounts to publish our client apps quickly, and yours could be a perfect match.

Re: Android developer verification: Early access starts

#460

Post by Arnt »

sharperguy wrote: post #437
OrangeMusic wrote: post #433

Earlier quoted context omitted.

Google wants 0 friction for apps to display ads.

What incentive is there for OEMs to not add this option though? Does Google refuse to veriy their firmware if they offer this feature?

The network permission was displayed in the first versions of Android, then removed. I heard (hearsay alert) at the time that it was because so many apps needed it, and they wanted to get rid of always-yes questions. IIRC this happened before the rise of in-app advertising.

If people always answer yes, they grow tired and eventually don't notice the question. I've seen it happen with "do you want to overwrite the previous version of the document you're editing, which you saved two minutes ago?" At that point your question is just poisoning the well. Makes sense, but still, hearsay alert.

Post reply on HN