Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google details new 24-hour process to sideload unverified Android apps

arstechnica.com

Post reply on HN
Print view View original

71–80 of 1001 posts

Re: Google details new 24-hour process to sideload unverified Android apps

#71

Post by tbodt »

hbn wrote: post #58
MishaalRahman wrote: post #40

Earlier quoted context omitted.

>- Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? Hi, I'm the community engagement manager @ Android. It's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you tur…

> ADB installs are not impacted by the waiting period, so that is an option if you need to install certain unregistered applications immediately. Someone is just going to make a nice GUI application for sideloading apks with a single drag-and-drop, so if your idea is that ADB is a way to ensure only "users who know what they're doing" are gonna sideload, you've done nothing. This is all security theatre.

> “For a lot of people in the world, their phone is their only computer, and it stores some of their most private information,” Samat said.

Not applying the policy to adb installs makes a lot more sense if the people this is trying to protect don't have a computer

Re: Google details new 24-hour process to sideload unverified Android apps

#72

Post by msl »

tadfisher wrote: post #3

Honestly, if coerced sideloading is a real attack vector , then this seems to be a pretty fair compromise. I just remain skeptical that this tactic is successful on modern Android, with all the settings and scare screens you need to go through in order to sideload an app and grant dangerous permissions. I expect scammers will move to pre-packaged software with a bundled ADB client for Windows/Mac, then the flow is "e…

> Honestly, if coerced sideloading is a real attack vector, [...]

I don't believe that it is. I follow this "scene" pretty closely, and that means I read about successful scams all the time. They happen in huge numbers. Yet I have never encountered a reliable report of one that utilized a "sideloaded"[1] malicious app. Not once. Phishing email messages and web sites, sure. This change will not help counter those, though.

I don't even see what you could accomplish with a malicious app that you couldn't otherwise. I would certainly be interested to hear of any real world cases demonstrating the danger.

[1] When I was a kid, this was called "installing."

Re: Google details new 24-hour process to sideload unverified Android apps

#73

Post by wolvoleo »

MishaalRahman wrote: post #40
astra1701 wrote: post #14

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably no…

>- Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? Hi, I'm the community engagement manager @ Android. It's my understanding that you don't have to keep developer options enabled after you enable the advanced flow. Once you make the change on your device, it's enabled. If you tur…

Do I need to be signed in to Google play to get the sideloading exception turned on? I don't sign in to it because I don't want to have my phone associated with a Google account. But I can't uninstall play completely on the devices I have.

It says something about 'restart your phone and reauthenticate' that's why I'm asking. What do you autenticate?

> ADB installs are not impacted by the waiting period, so that is an option if you need to install certain unregistered applications immediately.

Um yeah but then do I have to install every update via adb? I want to just use F-Droid.

Re: Google details new 24-hour process to sideload unverified Android apps

#74

Post by ninininino »

xnx wrote: post #28
astra1701 wrote: post #14

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably no…

> some apps (e.g., banking apps) will refuse to operate and such when developer mode is on JFC. Why would an app be allowed to know this? Just another datapoint for fingerprinting.

Because estimates suggest Americans lose about $119 billion annually to financial scams, which is a not insignificant fraction of our entire military budget, or more than 5% of annual social security expenditures.

Re: Google details new 24-hour process to sideload unverified Android apps

#76

Post by wolvoleo »

devsda wrote: post #68

Death, taxes and escalating safety are the only certainities in this tech dominated world. So, be ready for more safety in the next round few months/years down the line. Eventually Android will become as secure as ios. We need a third alternative before that day comes. It's not a win by any means. I hope that we don't stop making noise.

It's not secure when one of the main adversaries (Google) controls all the keys.

Re: Google details new 24-hour process to sideload unverified Android apps

#77

Post by ronsor »

nvme0n1p1 wrote: post #62
xnx wrote: post #30

Earlier quoted context omitted.

> The one-day waiting period is so arbitrary. Scammers aren't going to wait on the phone for a day with your elderly parent.

Have you ever watched Kitboga? Scammers call people back all the time. They keep spreadsheets of their marks like a CRM. It takes time to build trust and victimize someone, and these scammers are very patient.

Scammers will gladly wait on hold for 10 hours a day, for a week, if they think they'll get their Bitcoin.

They have infinite time and patience.

Re: Google details new 24-hour process to sideload unverified Android apps

#78

Post by free_bip »

xnx wrote: post #30
curt15 wrote: post #25

Earlier quoted context omitted.

The one-day waiting period is so arbitrary. Have they demonstrated any supporting data? We know google loves to flaunt data. Something like Github's approach of forcing users to type the name of the repo they wish to delete would seem to be more than sufficient to protect technically disinclined users while still allowing technically aware users to do what they please with their own device.

> The one-day waiting period is so arbitrary. Scammers aren't going to wait on the phone for a day with your elderly parent.

Brother, there's an entire genre of scamming where the scammers spend months building rapport with their victims, usually without ever asking for anything, before "cashing out". One day is nothing.

Re: Google details new 24-hour process to sideload unverified Android apps

#79

Post by aboringusername »

wolvoleo wrote: post #65

Do you need a Google account to opt out of the restriction? It says something about authenticating. I don't have a Google account on my Androids. But I can't remove play services on them, sadly. As an intermediate protection I just don't sign in to Google play, that gives them at least a bit less identifying information to play with. I hope this can be done without a Google account.

The reauthenticate means using device pin/biometrics if you have them enabled.

You will not need a Google account.

Re: Google details new 24-hour process to sideload unverified Android apps

#80

Post by [deleted] »

astra1701 wrote: post #14

This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably no…

[deleted]
Post reply on HN