The goal seems to be breaking the real-time guidance scammers rely on.
24h probably works, but it feels like a heavy tradeoff for legit users.
Google details new 24-hour process to sideload unverified Android apps
81–90 of 1001 posts
Re: Google details new 24-hour process to sideload unverified Android apps
#82This is going to hurt legitimate sideloading way more than actually necessary to reduce scams: - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? - One-day (day!!!) waiting period to activate (one-time) -- the vast majority of people who need to sideload something will probably no…
> - Must enable developer mode -- some apps (e.g., banking apps) will refuse to operate and such when developer mode is on, and so if you depend on such apps, I guess you just can't sideload? What apps are those? I've yet to run into any of my banking apps that refuse to run with developer mode enabled. I've seen a few that do that for rooted phones but that's a different story. I've been running android for a decade…
I enable developer mode on every android phone to at least change the animation durations to twice the speed. I also have never run into an issue fwiw
Re: Google details new 24-hour process to sideload unverified Android apps
#83Earlier quoted context omitted.
> some apps (e.g., banking apps) will refuse to operate and such when developer mode is on JFC. Why would an app be allowed to know this? Just another datapoint for fingerprinting.
Because estimates suggest Americans lose about $119 billion annually to financial scams, which is a not insignificant fraction of our entire military budget, or more than 5% of annual social security expenditures.
[flagged]
Re: Google details new 24-hour process to sideload unverified Android apps
#84Earlier quoted context omitted.
Why should the bank/institution be responsible for protecting individuals from themselves? They don't have police power- protecting people from bad actors is like, the reason to have a state. If the state wishes to farm it out to third parties, then we don't need the state anymore!
Yea I have no idea why the original commenter thinks Banks should have the power to tell me what I can and can't do with my own money. It's nice that Zelle has checks and identity information shown to you when you're sending money, but if I click through 5 screens that say "Yes I know this person" but I actually don't.....no amount of regulation is going to solve that.
Banks absolutely have that power and will stop transactions that seem suspicious or fraudulent already, no? Sometimes they'll call/text to verify you want it go through. I imagine that type of thing but cranked up for accounts flagged "vulnerable" where a family or the person themselves can check a box saying "yes, lockdown this account heavily please" (or whatever you can imagine, idk, I'm not a bank)
Re: Google details new 24-hour process to sideload unverified Android apps
#85Earlier quoted context omitted.
> The one-day waiting period is so arbitrary. Scammers aren't going to wait on the phone for a day with your elderly parent.
Sure, but what about a 30 minute delay? 1 hour? 2 hour? 24 is just so long. But also, my expectation is that a scammer is going to just automate the flow here anyways. Cool, you hit the "24 hour" wait period, I'll call you back tomorrow, the next day, or the next day and continue the scam process. It might stop some less sophisticated spammers for a little bit, but I expect that it'll just be a few tweaks to make it…
24 hours is long enough to get them off the phone, and potentially talking to other people who might recognize the scam.
There will be some proportion of people who mention to their spouse/child/friend about how Google called them to fix their phone, and are saved by that waiting period.
Re: Google details new 24-hour process to sideload unverified Android apps
#86Earlier quoted context omitted.
The apps might not be available though. Many developers are simply stopping in the face of Google's invasive policies. I don't blame them. Say goodbye to useful apps like Newpipe.
I don't see anything on NewPipe's website about not continuing development?
A few apps have been showing pop-ups warning users in advance that they are not going to do the verification. Obtanium is definitely on of them. I think I saw something similar on NewPipe.
Re: Google details new 24-hour process to sideload unverified Android apps
#87At this point I'm convinced that there's something deeply wrong with how our society treats technology.
Ruining Android for everyone to try to maybe help some rather technologically-hopeless groups of people is the wrong solution. It's unsustainable in the long run. Also, the last thing this world needs right now is even more centralization of power. Especially around yet another US company.
People who are unwilling to figure out the risks just should not use smartphones and the internet. They should not use internet banking. They should probably not have a bank account at all and just stick to cash. And the society should be able to accommodate such people — which is not that hard, really. Just roll back some of the so-called innovations that happened over the last 15 years. Whether someone uses technology, and how much they do, should be a choice, not a burden.
Re: Google details new 24-hour process to sideload unverified Android apps
#88Do you need a Google account to opt out of the restriction? It says something about authenticating. I don't have a Google account on my Androids. But I can't remove play services on them, sadly. As an intermediate protection I just don't sign in to Google play, that gives them at least a bit less identifying information to play with. I hope this can be done without a Google account.
The reauthenticate means using device pin/biometrics if you have them enabled. You will not need a Google account.
Oof that's what I was hoping for, thanks!
Re: Google details new 24-hour process to sideload unverified Android apps
#89Earlier quoted context omitted.
> ADB installs are not impacted by the waiting period, so that is an option if you need to install certain unregistered applications immediately. Someone is just going to make a nice GUI application for sideloading apks with a single drag-and-drop, so if your idea is that ADB is a way to ensure only "users who know what they're doing" are gonna sideload, you've done nothing. This is all security theatre.
> “For a lot of people in the world, their phone is their only computer, and it stores some of their most private information,” Samat said. Not applying the policy to adb installs makes a lot more sense if the people this is trying to protect don't have a computer
You can run adb install locally without a computer
Re: Google details new 24-hour process to sideload unverified Android apps
#90Earlier quoted context omitted.
> ADB installs are not impacted by the waiting period, so that is an option if you need to install certain unregistered applications immediately. Someone is just going to make a nice GUI application for sideloading apks with a single drag-and-drop, so if your idea is that ADB is a way to ensure only "users who know what they're doing" are gonna sideload, you've done nothing. This is all security theatre.
> “For a lot of people in the world, their phone is their only computer, and it stores some of their most private information,” Samat said. Not applying the policy to adb installs makes a lot more sense if the people this is trying to protect don't have a computer
I've seen a few apps that run locally on Android and hook into the ADB connection over loopback networking to do certain things.
This just adds the step of "download Cool ABD Installer from the play store" to the set of directions I would think.